#VU96363 Reachable assertion in Linux kernel - CVE-2023-52912

Vulnerability identifier: #VU96363

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52912

CWE-ID: CWE-617

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the amdgpu_vram_mgr_fini() function in drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.1, 6.1 rc1, 6.1 rc3, 6.1 rc7, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.2 rc5, 6.2 rc7

---

External links
https://git.kernel.org/stable/c/9196eb7c52e55749a332974f0081f77d53d60199
https://git.kernel.org/stable/c/99f1a36c90a7524972be5a028424c57fa17753ee
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.7
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.