CVE-2023-52921

What it actually does

Use-after-free in amdgpu_cs_pass1() caused by gang_size check outside the chunk parsing loop; the loop index is not reset before chunk data is freed, leaving a dangling reference.

Why it matters to the business

Local attackers on AMD GPU systems can crash the kernel or escalate privileges, disrupting graphics workloads and exposing sensitive data on affected Linux hosts.

How an attack unfolds

An attacker with local access submits crafted command streams that trigger the out-of-loop gang_size check, causing the driver to free chunk structures while a reference remains; subsequent use of the freed memory leads to arbitrary code execution or denial of service. Threat actors in 2024 zero-day espionage and financially motivated campaigns have shown interest in similar Linux kernel memory-safety issues.

How to fix it

Update the Linux kernel to a version containing the upstream fix for amdgpu_cs_pass1(); for the listed flashplugin-nonfree packages on Ubuntu 14.04 LTS apply version 11.2.202.554ubuntu0.14.04.1 or later.

How to confirm the fix worked

Confirm the installed kernel or package version matches or exceeds the fixed release; review kernel source for the reset of index i before chunk free in amdgpu_cs_pass1().

Typical attack path

1. Obtain local user access on a system with AMD GPU and the vulnerable amdgpu driver
2. Prepare command submission that exercises the gang_size check outside the chunk loop
3. Trigger chunk allocation and subsequent free without index reset
4. Reuse the dangling pointer to corrupt kernel memory or execute attacker-controlled code

How to detect it

Review kernel logs for amdgpu-related crashes or warnings around command submission; look for unexpected use of freed memory patterns in crash dumps. Threat actor campaigns targeting similar Linux kernel flaws may leave traces in process execution or module loading logs.

What your security team should do

• Prioritize kernel updates on all AMD GPU hosts within the next patching cycle
• Monitor for local privilege-escalation attempts targeting graphics subsystems
• Restrict untrusted local accounts from accessing GPU devices where possible