CVE-2023-53084

A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) shared memory helper. An incorrect reference count decrement in the drm_gem_shmem_mmap() error-handling path causes shared memory objects to be freed prematurely. A local user could exploit this vulnerability to trigger a use-after-free condition, resulting in a system crash and Denial of Service (DoS) or potential arbitrary code execution.

A moderate use-after-free flaw was found in the Linux kernel's Direct Rendering Manager (DRM) shared memory helper, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8 and 9. In the error-handling path of drm_gem_shmem_mmap(), a reference that the function does not own is released, causing a dma-buf shmem GEM object to be freed prematurely and leading to a later use-after-free. A local user could exploit this flaw to crash the system (denial of service); while the upstream record notes potential arbitrary code execution, Red Hat's CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) assesses the impact as availability only, which is lower than the 7.8 severity rated by NIST and CVE.org. Fixes for Red Hat Enterprise Linux 8 and 9 are currently deferred to a future kernel update; because exploitation requires authenticated local access and the flaw is rated moderate, the residual risk is limited to a local user causing a system crash or denial of service. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS, are not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.