CVE-2023-52913

What it actually does

Use-after-free in gem_context_register() where a context pointer remains usable after userspace visibility is granted, allowing a concurrent I915_GEM_CONTEXT_DESTROY ioctl to free the object before subsequent operations complete.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or potentially escalate privileges, leading to downtime, data exposure, or full host compromise; the issue affects widely deployed kernels with high ecosystem prevalence but carries low exploitation probability and no known active campaigns.

How an attack unfolds

An attacker with local access creates a graphics context, races the register call with a destroy ioctl from another thread to free the context, then reuses the dangling pointer through subsequent kernel operations on the freed object.

How to fix it

Upgrade the Linux kernel to a version containing commit ae278887193110dfeb857ea63e243a3851fbb0bc or later stable equivalents; apply the same fix to any downstream Android platform/system/bt builds dated after 2021-07-01 for the corresponding release branches.

How to confirm the fix worked

Verify the presence of the fix commit in the running kernel source or binary; confirm that gem_context_register performs the xarray insertion as its final operation on the context pointer; test with concurrent context creation and destruction workloads under memory debugging tools such as KASAN.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux kernel with i915 DRM enabled
2. Invoke gem_context_register to expose a context to userspace
3. Trigger I915_GEM_CONTEXT_DESTROY ioctl concurrently from a second thread
4. Reuse the now-freed context pointer in subsequent kernel code paths
5. Achieve memory corruption leading to crash or controlled code execution

How to detect it

Review kernel logs for i915 or drm context-related warnings or use-after-free reports; inspect audit logs for unusual sequences of I915_GEM_CONTEXT_CREATE and I915_GEM_CONTEXT_DESTROY ioctls from the same process; examine crash dumps for references to freed gem_context structures.

What your security team should do

• Prioritize kernel updates on all systems exposing i915 graphics to untrusted local users
• Monitor upstream stable branches for backports of ae278887193110dfeb857ea63e243a3851fbb0bc
• Restrict unprivileged access to DRM ioctls via AppArmor, SELinux, or seccomp where feasible
• Reboot systems after kernel package installation to load fixed modules