Cloudanix VulnDB

CVE-2023-53789

None

CVSS

—

EPSS

0.2%

Published

Dec 9, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing check in low-level system software can make computers using certain AMD hardware crash unexpectedly when handling memory access errors.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in AMD IOMMU page fault handler (report_iommu_fault) when domain for device group is unset, causing kernel oops during amd_iommu_int_thread processing.

Why it matters to the business

Kernel crashes on affected systems lead to unplanned downtime and service disruption; low prevalence and no KEV listing reduce immediate operational urgency despite 324 days since publication.

How an attack unfolds

An attacker or faulty device triggers an IOMMU page fault on an AMD system where the domain setup check is absent; the handler dereferences a null domain pointer, resulting in a supervisor read fault and kernel panic. No named threat actors or ransomware use observed.

How to fix it

Apply kernel patch adding domain-setup check before fault reporting; upgrade webkit2gtk on Ubuntu 16.04 LTS to 2.20.5-0ubuntu0.16.04.1 and on Ubuntu 18.04 LTS to 2.20.5-0ubuntu0.18.04.1 where applicable in downstream packages.

How to confirm the fix worked

Confirm kernel version contains the domain-setup guard in amd_iommu code; reproduce fault scenario and verify informative log message instead of NULL dereference oops; scan for updated webkit2gtk packages matching listed fixed versions.

Typical attack path

  1. Identify AMD IOMMU-enabled system with misconfigured device group domain
  2. Induce IOMMU page fault via device or driver action
  3. Execute amd_iommu_int_thread path without domain validation
  4. Trigger NULL dereference at report_iommu_fault+0x11
  5. Cause kernel oops and system instability

How to detect it

Review kernel logs for 'BUG: kernel NULL pointer dereference' combined with 'report_iommu_fault' and 'amd_iommu_int_thread' stack traces; correlate with irq/AMD-Vi thread activity preceding the oops.

  • BUG: kernel NULL pointer dereference, address: 0000000000000058
  • report_iommu_fault+0x11/0x90
  • amd_iommu_int_thread+0x60c/0x760
  • CPU:.*Comm: irq/.*-AMD-Vi

What your security team should do

  • Prioritize kernel updates on AMD IOMMU systems within standard patch cycles
  • Monitor EPSS trend (stable at ~0.002) and re-evaluate if new exploit maturity appears
  • Audit device driver initialization to ensure IOMMU domains are always configured before use

The record

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Improve page fault error reporting If IOMMU domain for device group is not setup properly then we may hit IOMMU page fault. Current page fault handler assumes that domain is always setup and it will hit NULL pointer derefence (see below sample log). Lets check whether domain is setup or not and log appropriate message. Sample log: ---------- amdgpu 0000:00:01.0: amdgpu: SE 1, SH per SE 1, CU per SH 8, active_cu_number 6 BUG: kernel NULL pointer dereference, address: 0000000000000058 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 56 Comm: irq/24-AMD-Vi Not tainted 6.2.0-rc2+ #89 Hardware name: xxx RIP: 0010:report_iommu_fault+0x11/0x90 [...] Call Trace: <TASK> amd_iommu_int_thread+0x60c/0x760 ? __pfx_irq_thread_fn+0x10/0x10 irq_thread_fn+0x1f/0x60 irq_thread+0xea/0x1a0 ? preempt_count_add+0x6a/0xa0 ? __pfx_irq_thread_dtor+0x10/0x10 ? __pfx_irq_thread+0x10/0x10 kthread+0xe9/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> [joro: Edit commit message]

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 6.1.16
Linux Kernel 5.16.0 6.1.16

Related vulnerabilities