CVE-2023-52678: drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.c
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Confirm list is non-empty before utilizing listfirstentry in kfdtopology.c
Before using listfirstentry, make sure to check that list is not empty, if list is empty return -ENODATA.
Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfdtopology.c:1347 kfdcreateindirectlinkprop() warn: can 'gpulink' even be NULL? drivers/gpu/drm/amd/amdgpu/../amdkfd/kfdtopology.c:1428 kfdaddpeerprop() warn: can 'iolink1' even be NULL? drivers/gpu/drm/amd/amdgpu/../amdkfd/kfdtopology.c:1433 kfdaddpeerprop() warn: can 'iolink2' even be NULL?
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
In kfd_topology.c, update kfd_create_indirect_link_prop() to confirm the list is non-empty before utilizing list_first_entry; if the list is empty, return -ENODATA.
Linux kernel (drivers/gpu/drm/amd/amdkfd/kfd_topology.c) kfd_create_indirect_link_prop(): list_first_entry usage = Check list is non-empty before calling list_first_entry; if empty return -ENODATA
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52678?
CVE-2023-52678 is considered a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2023-52678?
To fix CVE-2023-52678, update your Linux kernel to one of the patched versions listed, such as 5.10.223-1 or 6.12.11-1.
What does CVE-2023-52678 affect?
CVE-2023-52678 affects the DRM subsystem in the Linux kernel specifically related to the amdkfd component.
What is the nature of the vulnerability in CVE-2023-52678?
The nature of CVE-2023-52678 is an improper check for an empty list before utilizing list_first_entry, which can lead to a negative data error.
Which versions of the Linux kernel are vulnerable to CVE-2023-52678?
Versions of the Linux kernel prior to the fixed versions such as 5.10.223-1 and 6.12.11-1 are vulnerable to CVE-2023-52678.