CVE-2023-53646

A bounds-checking error was found in the Linux kernel Intel i915 graphics driver's performance monitoring subsystem. A local user with access to Intel GPU performance counters can trigger address validation for observability architecture counters on Xe-HP and newer hardware, causing the driver to read beyond the end of the xehp_oa_b_counters array due to a missing sentinel entry, which results in out-of-bounds memory access and denial of service through kernel crash or undefined behavior.

The issue arises because the xehp_oa_b_counters register array lacks a terminating sentinel entry (empty record) required by the reg_in_range_table validation function. When userspace interacts with the perf subsystem to configure GPU performance monitoring on affected Intel hardware (Meteor Lake and newer platforms with Xe-HP graphics), the kernel walks the array to validate counter addresses. Without the sentinel, the validation logic reads past the array boundary, accessing arbitrary adjacent kernel memory. KASAN detected a 4-byte out-of-bounds read in xehp_is_valid_b_counter_addr. While this is a memory safety violation, exploitation beyond denial of service is unlikely because the read occurs during validation logic with no direct mechanism to return the out-of-bounds data to userspace. The impact is primarily availability through potential kernel crashes or undefined behavior.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the i915 module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.