CVE-2023-52625 drm/amd/display: Refactor DMCUB enter/exit idle interface

What is CVE-2023-52625?

CVE-2023-52625 is a medium-severity denial of service vulnerability in Linux kernel, published on 26 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Refactor DMCUB enter/exit idle interface

[Why] We can hang in place trying to send commands when the DMCUB isn't powered on.

[How] We need to exit out of the idle state prior to sending a command, but the process that performs the exit also invokes a command itself.

Fixing this issue involves the following:

1. Using a software state to track whether or not we need to start the process to exit idle or notify idle.

It's possible for the hardware to have exited an idle state without driver knowledge, but entering one is always restricted to a driver allow - which makes the SW state vs HW state mismatch issue purely one of optimization, which should seldomly be hit, if at all.

2. Refactor any instances of exit/notify idle to use a single wrapper that maintains this SW state.

This works simialr to dc_allow_idle_optimizations, but works at the DMCUB level and makes sure the state is marked prior to any notify/exit idle so we don't enter an infinite loop.

3. Make sure we exit out of idle prior to sending any commands or waiting for DMCUB idle.

This patch takes care of 1/2. A future patch will take care of wrapping DMCUB command submission with calls to this new interface.

Which versions are affected by CVE-2023-52625?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2023-52625?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-52625 being exploited?

There is no known exploitation of CVE-2023-52625 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2023-52625, DEBIAN-CVE-2023-52625, GHSA-78r6-645f-335q, ROOT-OS-DEBIAN-11-CVE-2023-52625, ROOT-OS-DEBIAN-12-CVE-2023-52625, ROOT-OS-UBUNTU-2204-CVE-2023-52625 and 1 more.