CVE-2023-53009

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Add sync after creating vram bo

There will be data corruption on vram allocated by svm if the initialization is not complete and application is writting on the memory. Adding sync to wait for the initialization completion is to resolve this issue.

A low severity flaw was found in the Linux kernel AMD KFD (amdkfd) driver. Data corruption can occur on VRAM allocated via shared virtual memory (SVM) if an application writes to that memory before the initialization of the VRAM buffer object has completed, because the driver did not wait for initialization to finish after creating the buffer. Exploitation requires local access on systems using AMD graphics hardware with the amdkfd driver, and the impact is limited to data integrity. Red Hat assessed this issue as Low severity (CVSS 3.3, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), which differs from the higher external ratings (NIST 5.5, CVE.org 7.8) that assume broader confidentiality, integrity, and availability impact. In Red Hat Enterprise Linux 8 and 9, including the kernel-rt variants, the affected streams have a deferred resolution: given the low severity of this issue, the fix is being deferred to a future maintenance update rather than an urgent z-stream erratum. The residual risk until the fix is applied is that a local application may observe corrupted data in SVM-allocated VRAM when it writes to the memory during the initialization window. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS, are not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.