RCE in Linux
CVE-2023-52624
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wake DMCUB before executing GPINT commands [Why] DMCUB can be in idle when we attempt to interface with the HW through the GPINT mailbox resulting in a system hang. [How] Add dc_wake_and_execute_gpint() to wrap the wake, execute, sleep sequence. If the GPINT executes successfully then DMCUB will be put back into sleep after the optional response is returned. It functions similar to the inbox command interface.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.004 (29.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linux — versions 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, 4.15, 0
- Linux Linux_kernel
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2023-52624?
- CVE-2023-52624 is a high-severity vulnerability in Linux, classified under Command Injection. CVSS score: 7.8/10. Published 2024-03-26.
- How severe is CVE-2023-52624?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2023-52624 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.