What is CVE-2023-52485?

CVE-2023-52485 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, affecting Linux kernel versions from 4.15 onward and patched in 6.7.3 and 6.8. CVE-2023-52485 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2023-52485?

CVE-2023-52485 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2023-52485?

Yes, CVE-2023-52485 has been patched. Fixed versions include 6.7.3 and 6.8. If you are running Linux kernel 4.15 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2023-52485 actively exploited?

CVE-2023-52485 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2023-52485

Medium

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wake DMCUB before sending a command [Why] We can hang in place trying to send commands when the DMCUB isn't powered on. [How] For functions that execute within a DC context or DC lock we can wrap the direct calls to dm_execute_dmub_cmd/list with code that exits idle power optimizations and reallows once we're done with the command submission on success. For DM direct submissions the DM will need to manage the enter/exit sequencing manually. We cannot invoke a DMCUB command directly within the DM execution helper or we can deadlock.

Package Linux Kernel

Published 2024-02-29

Last modified 2025-01-09

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 4.15 and later are affected. Fixed in 6.7.3, 6.8 and their respective stable series.

Affected from

≥ 4.15

Fixed in

✓ 6.7.3 6.7.x ✓ 6.8

References

2 total

Kernel Git
https://git.kernel.org/stable/c/303197775a97416b62d4da69280d0c120a20e009

Patch
Kernel Git
https://git.kernel.org/stable/c/8892780834ae294bc3697c7d0e056d7743900b39

Patch

Details

CVE ID CVE-2023-52485

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2024-02-29

Modified 2025-01-09

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2023-52485?

CVE-2023-52485 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 4.15 onward and has been patched in 6.7.3 and 6.8. CVE-2023-52485 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2023-52485?

CVE-2023-52485 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2023-52485?

Yes. CVE-2023-52485 has been patched. Fixed versions include 6.7.3 and 6.8. If you are running Linux kernel 4.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2023-52485 actively exploited?

No. CVE-2023-52485 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.