CVE-2023-52812
drm/amd: check num of link levels when update pcie param
HIGH 7.8
At a glance
- Source
- NVD
- EPSS
- EPSS 0.26 % · percentile 18 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd: check num of link levels when update pcie param In SR-IOV environment, the value of pcie_table->num_of_link_levels will be 0, and num_of_levels - 1 will cause array index out of bounds
Weaknesses (CWE)
- CWE-129 — Improper Validation of Array Index
References
- https://git.kernel.org/stable/c/2f2d48b6247ae3001f83c98730b3cce475cb2927
- https://git.kernel.org/stable/c/5b4574b663d0a1a0a62d5232429b7db9ae6d0670
- https://git.kernel.org/stable/c/09f617219fe9ccd8d7b65dc3e879b5889f663b5a
- https://git.kernel.org/stable/c/406e8845356d18bdf3d3a23b347faf67706472ec
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-59642
- GCVE · GCVE-0-2023-52812
CERT-FR advisories
- CERTFR-2025-AVI-0002 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1031 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0717 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0693 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0632 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.19 < 6.1.119cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.5.13cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6 < 6.6.3
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected bd8cd38d3ac6b6410ac4e7401ef3dca057a9b285 < 2f2d48b6247ae3001f83c98730b3cce475cb2927 ; affected 31c7a3b378a136adc63296a2ff17645896fcf303 < 5b4574b663d0a1a0a62d5232429b7db9ae6d0670 ; affected 31c7a3b378a136adc63296a2ff17645896fcf303 < 09f617219fe9ccd8d7b65dc3e879b5889f663b5a ; affected 31c7a3b378a136adc63296a2ff17645896fcf303 < 406e8845356d18bdf3d3a23b347faf67706472ec ; affected a924e0fa77d0ce382346b7b4c8419cb47189fb58 ; affected 6.1.40 < 6.1.119 |
| Linux · Linux | affected 6.5 ; unaffected 0 < 6.5 ; unaffected 6.1.119 ≤ 6.1.* ; unaffected 6.5.13 ≤ 6.5.* ; unaffected 6.6.3 ≤ 6.6.* ; unaffected 6.7 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |