CVE-2023-52913

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-52913", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T06:07:11.017Z", "datePublished": "2024-08-21T06:10:54.540Z", "dateUpdated": "2026-08-05T09:11:58.161Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:11:58.161Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential context UAFs\n\ngem_context_register() makes the context visible to userspace, and which\npoint a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.\nSo we need to ensure that nothing uses the ctx ptr after this. And we\nneed to ensure that adding the ctx to the xarray is the *last* thing\nthat gem_context_register() does with the ctx pointer.\n\n[tursulin: Stable and fixes tags add/tidy.]\n(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is triggered through local DRM ioctls (I915_GEM_CONTEXT_CREATE_EXT / I915_GEM_CONTEXT_DESTROY) on an i915 render node (/dev/dri/renderD*), not via network or adjacent protocols.\nAC:L - The attacker fully controls both sides of the race by issuing concurrent create and destroy ioctls on the same DRM file from multiple threads, and can retry until the post-xa_store use of ctx wins against context_close.\nPR:L - Both ioctls are marked DRM_RENDER_ALLOW and require only an open render node, which unprivileged local users routinely have on Intel GPU systems (desktop render group, ChromeOS, Android), not real root or init-namespace admin.\nUI:N - Exploitation requires no victim action; the attacker opens the render node and issues the racing ioctls themselves.\nS:U - Impact stays within the host kernel authority as a local privilege-escalation style memory-corruption bug; it does not cross VM, IOMMU, or other security boundaries.\nC:H - This is a use-after-free of struct i915_gem_context (freed via context_close -> kref_put -> kfree_rcu), which per scoring guidance enables reclaim and arbitrary kernel read primitives.\nI:H - The UAF races list_add against list_del/free on ctx client and global context lists, enabling heap corruption and write/control-flow hijack primitives consistent with High integrity impact for UAFs.\nA:H - Use-after-free of the GEM context reliably yields kernel oops/panic or list corruption crashes even when not fully exploited for code execution."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_context.c"], "versions": [{"version": "eb4dedae920a07c485328af3da2202ec5184fb17", "lessThan": "ae278887193110dfeb857ea63e243a3851fbb0bc", "status": "affected", "versionType": "git"}, {"version": "eb4dedae920a07c485328af3da2202ec5184fb17", "lessThan": "b696c627b3f56e173f7f70b8487d66da8ff22506", "status": "affected", "versionType": "git"}, {"version": "eb4dedae920a07c485328af3da2202ec5184fb17", "lessThan": "afce71ff6daa9c0f852df0727fe32c6fb107f0fa", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_context.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.171", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.7", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.171"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ae278887193110dfeb857ea63e243a3851fbb0bc"}, {"url": "https://git.kernel.org/stable/c/b696c627b3f56e173f7f70b8487d66da8ff22506"}, {"url": "https://git.kernel.org/stable/c/afce71ff6daa9c0f852df0727fe32c6fb107f0fa"}], "title": "drm/i915: Fix potential context UAFs", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52913", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:34:42.812004Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:12.564Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52913", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:34:42.812004Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:16.084Z"}}], "cna": {"title": "drm/i915: Fix potential context UAFs", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is triggered through local DRM ioctls (I915_GEM_CONTEXT_CREATE_EXT / I915_GEM_CONTEXT_DESTROY) on an i915 render node (/dev/dri/renderD*), not via network or adjacent protocols.\nAC:L - The attacker fully controls both sides of the race by issuing concurrent create and destroy ioctls on the same DRM file from multiple threads, and can retry until the post-xa_store use of ctx wins against context_close.\nPR:L - Both ioctls are marked DRM_RENDER_ALLOW and require only an open render node, which unprivileged local users routinely have on Intel GPU systems (desktop render group, ChromeOS, Android), not real root or init-namespace admin.\nUI:N - Exploitation requires no victim action; the attacker opens the render node and issues the racing ioctls themselves.\nS:U - Impact stays within the host kernel authority as a local privilege-escalation style memory-corruption bug; it does not cross VM, IOMMU, or other security boundaries.\nC:H - This is a use-after-free of struct i915_gem_context (freed via context_close -> kref_put -> kfree_rcu), which per scoring guidance enables reclaim and arbitrary kernel read primitives.\nI:H - The UAF races list_add against list_del/free on ctx client and global context lists, enabling heap corruption and write/control-flow hijack primitives consistent with High integrity impact for UAFs.\nA:H - Use-after-free of the GEM context reliably yields kernel oops/panic or list corruption crashes even when not fully exploited for code execution."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "eb4dedae920a07c485328af3da2202ec5184fb17", "lessThan": "ae278887193110dfeb857ea63e243a3851fbb0bc", "versionType": "git"}, {"status": "affected", "version": "eb4dedae920a07c485328af3da2202ec5184fb17", "lessThan": "b696c627b3f56e173f7f70b8487d66da8ff22506", "versionType": "git"}, {"status": "affected", "version": "eb4dedae920a07c485328af3da2202ec5184fb17", "lessThan": "afce71ff6daa9c0f852df0727fe32c6fb107f0fa", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_context.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"status": "unaffected", "version": "0", "lessThan": "5.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.171", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.7", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_context.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ae278887193110dfeb857ea63e243a3851fbb0bc"}, {"url": "https://git.kernel.org/stable/c/b696c627b3f56e173f7f70b8487d66da8ff22506"}, {"url": "https://git.kernel.org/stable/c/afce71ff6daa9c0f852df0727fe32c6fb107f0fa"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential context UAFs\n\ngem_context_register() makes the context visible to userspace, and which\npoint a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.\nSo we need to ensure that nothing uses the ctx ptr after this. And we\nneed to ensure that adding the ctx to the xarray is the *last* thing\nthat gem_context_register() does with the ctx pointer.\n\n[tursulin: Stable and fixes tags add/tidy.]\n(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.171", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.7", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.2", "versionStartIncluding": "5.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:11:58.161Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52913", "state": "PUBLISHED", "dateUpdated": "2026-08-05T09:11:58.161Z", "dateReserved": "2024-08-21T06:07:11.017Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-21T06:10:54.540Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_context.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ae278887193110dfeb857ea63e243a3851fbb0bc", "status": "affected", "version": "eb4dedae920a07c485328af3da2202ec5184fb17", "versionType": "git"}, {"lessThan": "b696c627b3f56e173f7f70b8487d66da8ff22506", "status": "affected", "version": "eb4dedae920a07c485328af3da2202ec5184fb17", "versionType": "git"}, {"lessThan": "afce71ff6daa9c0f852df0727fe32c6fb107f0fa", "status": "affected", "version": "eb4dedae920a07c485328af3da2202ec5184fb17", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_context.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.171", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "06BCA914-E4BD-46C7-A8F5-74061C8BC138", "versionEndExcluding": "5.9", "versionStartIncluding": "5.8.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7349455C-BBB3-4263-B0EA-BC54BA76B4C7", "versionEndExcluding": "6.1.7", "versionStartIncluding": "5.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*", "matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*", "matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential context UAFs\n\ngem_context_register() makes the context visible to userspace, and which\npoint a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.\nSo we need to ensure that nothing uses the ctx ptr after this. And we\nneed to ensure that adding the ctx to the xarray is the *last* thing\nthat gem_context_register() does with the ctx pointer.\n\n[tursulin: Stable and fixes tags add/tidy.]\n(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)"}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/i915: corrige posibles UAF de contexto gem_context_register() hace que el contexto sea visible para el espacio de usuario, y en qu\u00e9 punto un hilo separado puede activar el ioctl I915_GEM_CONTEXT_DESTROY. Por lo tanto, debemos asegurarnos de que nada use ctx ptr despu\u00e9s de esto. Y debemos asegurarnos de que agregar ctx al xarray sea lo *\u00faltimo* que hace gem_context_register() con el puntero ctx. [tursulin: etiquetas estables y corregidas agregadas/ordenadas.] (seleccionado de el commit bed4b455cf5374e68879be56971c1da563bcd90c)"}], "id": "CVE-2023-52913", "lastModified": "2026-08-04T10:18:48.733", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-52913", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:34:42.812004Z", "version": "2.0.3"}}]}, "published": "2024-08-21T07:15:07.087", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae278887193110dfeb857ea63e243a3851fbb0bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/afce71ff6daa9c0f852df0727fe32c6fb107f0fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b696c627b3f56e173f7f70b8487d66da8ff22506"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/i915: Fix potential context UAFs", "id": "2306441", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2306441"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/i915: Fix potential context UAFs\ngem_context_register() makes the context visible to userspace, and which\npoint a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.\nSo we need to ensure that nothing uses the ctx ptr after this. And we\nneed to ensure that adding the ctx to the xarray is the *last* thing\nthat gem_context_register() does with the ctx pointer.\n[tursulin: Stable and fixes tags add/tidy.]\n(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)", "A vulnerability was found in the Linux Kernel's Intel graphics driver (drm/i915), where a use-after-free (UAF) condition can occur in the `gem_context_register()` function. When this function is called, it makes a graphics context visible to the userspace, which allows a separate thread to invoke the `I915_GEM_CONTEXT_DESTROY` ioctl and free the context while it is still in use."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2023-52913", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-52913\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52913\nhttps://lore.kernel.org/linux-cve-announce/2024082115-CVE-2023-52913-5347@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux Kernel used in its distributions.", "threat_severity": "Moderate"}

{}