CVE-2023-52649

What it actually does

Out-of-bounds read in the vkms DRM driver when the floor LUT index is the final array entry, causing the ceil index to reference memory past the allocated table and potentially disclosing kernel data or triggering faults.

Why it matters to the business

Local users on affected Linux systems can trigger kernel memory corruption or crashes, leading to denial of service, privilege escalation, or information leaks that impact system stability and confidentiality.

How an attack unfolds

An attacker with local access crafts input that positions the floor LUT index at the last valid entry, forcing the driver to dereference an out-of-bounds ceil index during color conversion and read arbitrary kernel memory.

How to fix it

Update the Linux kernel to a version containing commit 9556c167673057d48ce4a0da675026fe046654c1 or later; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Confirm the running kernel contains commit 9556c167673057d48ce4a0da675026fe046654c1 via git log or uname output, and test LUT operations near array boundaries to ensure no out-of-bounds accesses occur.

Typical attack path

1. Obtain local user access on a system using the vkms driver
2. Trigger graphics operations that invoke LUT-based color calculations with a floor index at the array boundary
3. Read or corrupt adjacent kernel memory through the resulting out-of-bounds access
4. Escalate privileges or cause denial of service

How to detect it

Review kernel logs for oops or page-fault messages referencing vkms LUT access; inspect for unexpected graphics-related crashes or memory corruption indicators after recent display operations.

What your security team should do

• Prioritize kernel upgrades on all systems exposing vkms or DRM graphics interfaces
• Apply the fix within standard patch windows unless the system is multi-tenant or processes untrusted graphics workloads
• Monitor vendor advisories for backported patches in distribution kernels