CVE-2023-53547

An invalid pointer dereference flaw was found in the Linux kernel AMD GPU SDMA v4 driver's cleanup code. On systems with SDMA 4.2.2 hardware, driver unload or system shutdown triggers the sdma_v4_0_sw_fini() cleanup path, which attempts to release firmware using an uninitialized or corrupted pointer, causing a general protection fault with a non-canonical address and denial of service through kernel crash.

For SDMA 4.2.2 hardware, sdma_v4_0_sw_fini() fails to properly handle firmware context cleanup. During driver finalization, the code calls amdgpu_sdma_destroy_inst_ctx() which attempts to release firmware via amdgpu_ucode_release(). The firmware pointer appears to be uninitialized or corrupted, causing free_fw_priv() to dereference an invalid address (0xd5e5a4ae79d24a32).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the amdgpu module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.