Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-52673
CVE-2023-52673:
Linux Kernel vulnerability analysis and mitigation
Overview
A vulnerability was identified in the Linux kernel's drm/amd/display subsystem, specifically related to a null pointer dereference issue in debugfs. The vulnerability, tracked as CVE-2023-52673, was discovered and involves the getsubvpen() callback function in the AMD display driver. The issue was officially recorded on March 7, 2024, affecting various Linux kernel versions (CVE Mitre, Debian Tracker).
Technical details
The vulnerability stems from a null pointer error in the Linux kernel's AMD display driver, specifically in the debugfs functionality. The issue occurs when the getsubvpen() callback is called without first verifying its existence. The fix involves adding a check to verify whether the getsubvpen() callback exists before attempting to call it, as demonstrated in the kernel patch (Kernel Patch).
Impact
The vulnerability affects multiple Linux distributions and versions, including Debian Bullseye (5.10.223-1 and 5.10.234-1) and Bookworm (6.1.123-1 and 6.1.128-1), which were marked as vulnerable. The issue has been fixed in newer versions such as Debian Trixie (6.12.12-1) and Sid (6.12.16-1) (Debian Tracker).
Mitigation and workarounds
The vulnerability has been patched in the Linux kernel with commit 43235db21fc23559f50a62f8f273002eeb506f5a. The fix implements a proper check for the getsubvpen() callback's existence before attempting to use it. Users are advised to upgrade to the fixed versions: Debian Trixie (6.12.12-1) or later, or Debian Sid (6.12.16-1) or later (Kernel Patch).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management