Executive brief
A vulnerability in the AMD GPU driver (amdgpu) in the Linux kernel could allow an attacker to trigger an out-of-bounds memory access when mapping GPU buffer objects. This could lead to kernel memory disclosure, denial of service, or privilege escalation on systems with AMD GPUs. The flaw arises from insufficient validation of buffer offset and size parameters.
Technical details
The vulnerability is an integer overflow / out-of-bounds access in amdgpu_vm_update_range when offset_in_bo + map_size overflows. The vulnerable functions amdgpu_vm_bo_map and amdgpu_vm_bo_replace_map failed to properly validate that offset + size does not overflow. This could allow local attackers with access to the DRM device interface to pass malformed parameters that bypass validation checks, leading to out-of-bounds memory access in the GPU virtual memory mapping code. The fix adds explicit overflow checks: `if (saddr + size <= saddr || offset + size <= offset) return -EINVAL;` before processing the mapping. No special privileges are documented as required beyond access to the DRM/GPU interface. A patch is available in the mainline Linux kernel.
Affected products
- Linux Linux kernel Multiple versions; patch available in stable branches
Timeline
- 2023-06-01: disclosed: Patch authored by Chia-I Wu
- 2023-07-23: patched: Merged to linux-5.15.y and later stable branches
- 2025-12-09: advisory: CVE-2023-53819 published