{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2023-52867",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2023-52867"
  ],
  "published": "2024-05-21T15:34:20Z",
  "summary": "drm/radeon: possible buffer overflow",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: possible buffer overflow\n\nBuffer 'afmt_status' of size 6 could overflow, since index 'afmt_idx' is\nchecked after access.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.63",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52867"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/112d4b02d94bf9fa4f1d3376587878400dd74783"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/caaa74541459c4c9e2c10046cf66ad2890483d0f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ddc42881f170f1f518496f5a70447501335fc783"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7b063c93bece827fde237fae1c101bceeee4e896"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/347f025a02b3a5d715a0b471fc3b1439c338ad94"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/341e79f8aec6af6b0061b8171d77b085835c6a58"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d9b4fa249deaae1145d6fc2b64dae718e5c7a855"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/19534a7a225f1bf2da70a9a90d41d0215f8f6b45"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/dd05484f99d16715a88eedfca363828ef9a4c2d4"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:24:39Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.1,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The flaw is in the local radeon IH IRQ path (PCI interrupt \u2192 radeon_driver_irq_handler_kms \u2192 evergreen_irq_process) on evergreen/sumo/btc/cayman/trinity GPUs; it is not reachable via network protocols or remote peers.\nAC:L - When an IH entry with src_id 44 and out-of-range src_data is present, the out-of-bounds afmt_status index is used deterministically with no race or layout dependency; under the uncertainty rule this is scored Low rather than requiring attacker-uncontrollable hardware glitches.\nPR:L - Reachability is on systems where an ordinary local account can use DRM/seat GPU access (render/primary nodes, HDMI audio activity that exercises AFMT IRQs), which does not require real init-namespace root; Low is chosen over High under the higher-severity rule.\nUI:N - IRQ processing runs in kernel interrupt context from GPU-generated IH entries; no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - Any resulting oops or memory access stays inside the host kernel/radeon driver authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - afmt_idx is taken from 28-bit IH src_data and used to index afmt_status[6] before the bounds check, yielding an unbounded out-of-bounds kernel read; per kernel CNA guidance such OOB reads are High unless strictly bounded.\nI:N - The only store (afmt_status[afmt_idx] &= ~AFMT_AZ_FORMAT_WTRIG) runs after if (afmt_idx > 5) break, so out-of-range indices never write; there is no OOB write or control-flow hijack primitive.\nA:H - A sufficiently large src_data makes the OOB read touch unmapped memory and oops in IRQ context; any kernel oops/panic is High availability impact."
    }
  }
}