CVE-2023-52691: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52691 is a vulnerability discovered in the Linux kernel affecting the AMD graphics driver component. The issue was specifically identified in the DPM (Dynamic Power Management) initialization code for AMD Southern Islands (SI) GPUs. The vulnerability was disclosed and patched in December 2023, affecting various Linux kernel versions (Kernel Git).

The vulnerability is a double-free bug in the si_dpm_init function within the AMD graphics driver. The issue occurs when the allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, triggering amdgpu_free_extended_power_table to free some fields of adev. When the control flow returns to si_dpm_sw_init, it goes to label dpm_failed and calls si_dpm_fini, which calls amdgpu_free_extended_power_table again, resulting in a double-free condition (Kernel Git).

A double-free vulnerability can potentially lead to memory corruption, which could result in system crashes or potential privilege escalation. The issue affects systems running Linux kernels with AMD Southern Islands GPU support (Debian LTS).

The vulnerability requires local access to the system with AMD Southern Islands GPU hardware. It can be triggered through the graphics driver initialization process when specific memory allocation failures occur (Kernel Git).

The issue has been fixed in the Linux kernel through a patch that removes the initial call to amdgpu_free_extended_power_table when allocation fails, preventing the double-free condition. The fix has been backported to various Linux distributions including Debian 10 (Buster) in version 5.10.209-2~deb10u1 (Debian LTS).