CVE-2023-53090

A flaw was found in the Linux kernel's AMD GPU driver (amdkfd). This vulnerability allows a local user to cause a Denial of Service (DoS) by crashing the system. By triggering a failure during data copying from user space in the event-handling interface, the driver executes error cleanup code that attempts to access uninitialized memory, resulting in an illegal memory access and a kernel crash.

A flaw was found in the Linux kernel's AMDKFD (AMD GPU compute) driver as shipped in Red Hat Enterprise Linux 9. A local user can trigger a failure in the copy_from_user() operation within the kfd_wait_on_events() event-wait handling path; the error-handling path then accesses the uninitialized event field of the allocated kfd_event_waiter structures during cleanup, causing an illegal memory access that crashes the kernel and results in a denial of service. Red Hat rates this flaw as Moderate with availability-only impact (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while NIST (7.1) and CVE.org (7.8) assign higher severity scores that include confidentiality and integrity impacts. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products. The fix for the affected Red Hat Enterprise Linux 9 kernel and kernel-rt components is deferred to a future release because the flaw is a local, availability-only denial of service with limited risk; the residual risk of the deferral is that a local user could crash the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.