CVE-2023-53378

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dpt: Treat the DPT BO as a framebuffer

Currently i915_gem_object_is_framebuffer() doesn't treat the BO containing the framebuffer's DPT as a framebuffer itself. This means eg. that the shrinker can evict the DPT BO while leaving the actual FB BO bound, when the DPT is allocated from regular shmem.

That causes an immediate oops during hibernate as we try to rewrite the PTEs inside the already evicted DPT obj.

TODO: presumably this might also be the reason for the DPT related display faults under heavy memory pressure, but I'm still not sure how that would happen as the object should be pinned by intel_dpt_pin() while in active use by the display engine...

(cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a)

A low impact flaw was found in the Linux kernel's Intel i915 graphics driver as shipped in Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9. The function i915_gem_object_is_framebuffer() did not treat the buffer object (BO) holding a framebuffer's display page table (DPT) as a framebuffer itself. Consequently, when the DPT was allocated from regular shmem, the memory shrinker could evict the DPT BO under memory pressure while the actual framebuffer BO remained bound, and the subsequent rewrite of the page table entries inside the already evicted DPT object caused an immediate kernel oops during system hibernation. The flaw is local and affects availability only, with no confidentiality or integrity impact (Red Hat CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The upstream CVE record assigns a higher severity (7.8, Important) that assumes confidentiality and integrity impact; Red Hat's analysis does not support those impact types, so Red Hat rates this flaw Low. The vulnerable code is present in the RHEL 8 and RHEL 9 kernel and kernel-rt packages. Because the issue is of low severity, affects availability only, and requires specific conditions (memory pressure and hibernation with the DPT allocated from regular shmem), the fix is deferred for these releases; the residual risk is a kernel oops (system crash) during hibernation and possible DPT-related display faults under heavy memory pressure on affected Intel graphics systems. The vulnerable code is not present in Red Hat Enterprise Linux 6, 7, and 10 or in Red Hat In-Vehicle OS 1, so those products are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.