CVE-2023-52867

What it actually does

Buffer 'afmt_status' of size 6 can be accessed with unchecked index 'afmt_idx' in drm/radeon driver, allowing out-of-bounds write.

Why it matters to the business

Older Ubuntu Linux systems using radeon graphics may experience crashes or potential code execution, increasing downtime and patch urgency across legacy deployments with high downstream kernel dependents.

How an attack unfolds

An attacker with local access crafts input to reach the afmt_status access before the index check in the radeon driver; Android Kernel Remote Code Execution Vulnerability actors could chain this for privilege escalation on affected kernels.

How to fix it

Upgrade to fixed kernel versions including linux 3.13.0-83.127, linux-aws 4.4.0-1002.2, linux-lts-xenial 4.4.0-13.29~14.04.1, linux 4.4.0-4.19, linux-aws 4.4.0-1001.10, linux-gke 4.4.0-1003.3, linux-hwe 4.8.0-36.36~16.04.1, linux-raspi2 4.4.0-1003.4, linux-snapdragon 4.4.0-1012.12, linux-lts-utopic 3.16.0-67.87~14.04.1, linux-lts-vivid 3.19.0-56.62~14.04.1, and linux-lts-wily 4.2.0-30.35~14.04.1.

How to confirm the fix worked

Verify running kernel version matches or exceeds listed fixed packages and confirm absence of the unchecked afmt_idx access in drm/radeon source.

Typical attack path

1. Gain local access to vulnerable Ubuntu system
2. Load or trigger drm/radeon code path with crafted afmt_idx
3. Trigger out-of-bounds write via unchecked array access
4. Escalate privileges or cause denial of service

How to detect it

Review kernel logs for radeon driver crashes or afmt-related oops messages; correlate with process activity on systems running affected kernels exploited by Android Kernel Remote Code Execution Vulnerability actors.

What your security team should do

• Immediately patch all listed affected Ubuntu 14.04/16.04 kernels to specified fixed versions
• Prioritize systems with radeon hardware in production
• Monitor EPSS trend for any increase and test patches in staging environments