CVE-2023-53677
Description
A memory leak flaw was found in the Linux kernel's Intel i915 graphics driver in the selftest page allocation logic. A local user can trigger this issue when running i915 selftests and the fake_get_pages function encounters errors, causing the function to return without freeing previously allocated memory. This results in a permanent memory leak leading to resource exhaustion and denial of service.
Statement
The fake_get_pages function in the i915 selftest code allocates various resources but fails to free them when encountering errors in certain paths. When the function returns early due to error conditions, allocated pages and other structures remain unreleased. Since selftests are typically run during driver testing or validation rather than normal operation, the practical impact is limited to development and testing scenarios. However, if selftests are executed in production environments or during automated testing cycles, the accumulated leaks could cause memory exhaustion.
Mitigation
To mitigate this issue, prevent the i915 module from being loaded, or avoid running i915 driver selftests until updates are applied. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
