{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53753","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-12-08T01:18:04.279Z","datePublished":"2025-12-08T01:19:13.743Z","dateUpdated":"2026-08-05T09:15:50.057Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:15:50.057Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix mapping to non-allocated address\n\n[Why]\nThere is an issue mapping non-allocated location of memory.\nIt would allocate gpio registers from an array out of bounds.\n\n[How]\nPatch correct numbers of bounds for using."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The amdgpu/DC display stack is a local device driver; the out-of-bounds indexing is reached through driver initialization and DDC/I2C transactions driven by local DRM ioctls on /dev/dri/card* (forced connector probe → drm_get_edid → dc_submit_i2c → dal_ddc_open → define_ddc_registers). There is no network-facing path to this code.\nAC:L - On an affected DCN2/DCN3/DCN3.2 board whose VBIOS maps a DDC/OEM-I2C line to the DC_GPIO_DDCVGA_A pad, en==GPIO_DDC_LINE_DDC_VGA is produced deterministically and the &ddc_shift[6]/&ddc_mask[6] overread happens on every gpio open — no race, no memory-layout grooming, and the attacker can repeat connector probes at will.\nPR:L - An unprivileged local user with a normal DRM/render node handle (video/render group, granted to the active logind session on desktops and to app processes on Android) can force connector detection and EDID/I2C traffic over the affected DDC line; no CAP_SYS_ADMIN or root is required.\nUI:N - The vulnerable path is entered by the driver itself at resource-pool/link init and by any programmatic connector probe or i2c transfer; no victim action such as plugging a monitor or opening a file is needed.\nS:U - The out-of-bounds access and its effects are entirely within the kernel's own security authority (kernel .rodata read plus GPU register programming by the same driver); no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an out-of-bounds read of 40 bytes of kernel .rodata beyond the end of ddc_shift[]/ddc_mask[] — well past a \"few bytes\" — and the leaked adjacent kernel constants are consumed as bitfield descriptors whose effect on the GPIO/I2C register state is observable to the caller performing DDC transactions.\nI:H - The out-of-bounds-derived shift and mask values are fed directly into REG_SET/REG_UPDATE read-modify-write sequences against the GPU's DDC GPIO MASK register, so arbitrary unintended bits of live hardware control registers are overwritten with values the driver never validated.\nA:H - Misprogramming the DDC/I2C pad control bits wedges display detection and I2C on that line, and the global-out-of-bounds access plus the resulting out-of-range shift counts trigger KASAN/UBSAN reports that panic the kernel under panic_on_warn, which is standard on hardened and Android builds."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c","drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c","drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c","drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h"],"versions":[{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","lessThan":"8ce8a443ddd9002861a4ee8a7e33a0c02717422f","status":"affected","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","lessThan":"24aaf6603600d6d1159973c809ea2737664b28c4","status":"affected","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","lessThan":"9190d4a263264eabf715f5fc1827da45e3fdc247","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c","drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c","drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c","drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h"],"versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","status":"unaffected","versionType":"semver"},{"version":"6.1.16","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.2.3","lessThanOrEqual":"6.2.*","status":"unaffected","versionType":"semver"},{"version":"6.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.1.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.2.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8ce8a443ddd9002861a4ee8a7e33a0c02717422f"},{"url":"https://git.kernel.org/stable/c/24aaf6603600d6d1159973c809ea2737664b28c4"},{"url":"https://git.kernel.org/stable/c/9190d4a263264eabf715f5fc1827da45e3fdc247"}],"title":"drm/amd/display: fix mapping to non-allocated address","x_generator":{"engine":"bippy-1.2.0"}}}}