CVE-2023-52916 (GCVE-0-2023-52916)

Vulnerability from cvelistv5 – Published: 2024-09-06 09:07 – Updated: 2026-08-05 09:11
VLAI
Title
media: aspeed: Fix memory overwrite if timing is 1600x900
Summary
In the Linux kernel, the following vulnerability has been resolved: media: aspeed: Fix memory overwrite if timing is 1600x900 When capturing 1600x900, system could crash when system memory usage is tight. The way to reproduce this issue: 1. Use 1600x900 to display on host 2. Mount ISO through 'Virtual media' on OpenBMC's web 3. Run script as below on host to do sha continuously #!/bin/bash while [ [1] ]; do find /media -type f -printf '"%h/%f"\n' | xargs sha256sum done 4. Open KVM on OpenBMC's web The size of macro block captured is 8x8. Therefore, we should make sure the height of src-buf is 8 aligned to fix this issue.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d2b4387f3bdf016e266d23cf657465f557721488 , < 4c823e4027dd1d6e88c31028dec13dd19bc7b02d (git)
Affected: d2b4387f3bdf016e266d23cf657465f557721488 , < c281355068bc258fd619c5aefd978595bede7bfe (git)
Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52916",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-09T20:43:04.212290Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T13:22:28.595Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:36:16.639Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/aspeed/aspeed-video.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c823e4027dd1d6e88c31028dec13dd19bc7b02d",
              "status": "affected",
              "version": "d2b4387f3bdf016e266d23cf657465f557721488",
              "versionType": "git"
            },
            {
              "lessThan": "c281355068bc258fd619c5aefd978595bede7bfe",
              "status": "affected",
              "version": "d2b4387f3bdf016e266d23cf657465f557721488",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/aspeed/aspeed-video.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: aspeed: Fix memory overwrite if timing is 1600x900\n\nWhen capturing 1600x900, system could crash when system memory usage is\ntight.\n\nThe way to reproduce this issue:\n1. Use 1600x900 to display on host\n2. Mount ISO through \u0027Virtual media\u0027 on OpenBMC\u0027s web\n3. Run script as below on host to do sha continuously\n  #!/bin/bash\n  while [ [1] ];\n  do\n\tfind /media -type f -printf \u0027\"%h/%f\"\\n\u0027 | xargs sha256sum\n  done\n4. Open KVM on OpenBMC\u0027s web\n\nThe size of macro block captured is 8x8. Therefore, we should make sure\nthe height of src-buf is 8 aligned to fix this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through the local V4L2 device node (/dev/video*) via open, VIDIOC_S_DV_TIMINGS, and streaming ioctls on the BMC; the kernel does not process network packets in this driver.\nAC:L - Any non-8-aligned capture height (e.g. 1600x900) reliably allocates an undersized DMA buffer and the hardware always writes past it; an attacker who can open the device can set such timings and start streaming without depending on conditions outside their control.\nPR:L - The driver performs no capability checks; access requires only open permission on the V4L2 device (typically video-group membership), not real root or init-namespace admin privileges.\nUI:N - A local attacker with device access can open the capture device, set undersized timings, and start streaming themselves without any separate victim action.\nS:U - Impact is memory corruption within the same BMC kernel security authority that hosts the vulnerable driver; this is standard local privilege escalation, not a cross-boundary escape.\nC:H - The out-of-bounds DMA write is substantial kernel memory corruption (~25KB at 1600x900, more at other non-aligned modes) that can be leveraged for information disclosure primitives.\nI:H - Hardware DMA performs a large out-of-bounds write of capturable framebuffer data into adjacent coherent DMA/kernel memory, which is exploitable for integrity compromise and control-flow hijacking.\nA:H - The memory overwrite is documented to crash the system (kernel oops/panic) under realistic OpenBMC KVM capture workloads."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:59.259Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c823e4027dd1d6e88c31028dec13dd19bc7b02d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c281355068bc258fd619c5aefd978595bede7bfe"
        }
      ],
      "title": "media: aspeed: Fix memory overwrite if timing is 1600x900",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52916",
    "datePublished": "2024-09-06T09:07:50.462Z",
    "dateReserved": "2024-08-21T06:07:11.017Z",
    "dateUpdated": "2026-08-05T09:11:59.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52916",
      "date": "2026-08-11",
      "epss": "0.00218",
      "percentile": "0.12378"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: aspeed: Fix memory overwrite if timing is 1600x900\\n\\nWhen capturing 1600x900, system could crash when system memory usage is\\ntight.\\n\\nThe way to reproduce this issue:\\n1. Use 1600x900 to display on host\\n2. Mount ISO through \u0027Virtual media\u0027 on OpenBMC\u0027s web\\n3. Run script as below on host to do sha continuously\\n  #!/bin/bash\\n  while [ [1] ];\\n  do\\n\\tfind /media -type f -printf \u0027\\\"%h/%f\\\"\\\\n\u0027 | xargs sha256sum\\n  done\\n4. Open KVM on OpenBMC\u0027s web\\n\\nThe size of macro block captured is 8x8. Therefore, we should make sure\\nthe height of src-buf is 8 aligned to fix this issue.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: aspeed: corrige la sobrescritura de memoria si el tiempo es 1600x900 Al capturar 1600x900, el sistema podr\\u00eda bloquearse cuando el uso de la memoria del sistema es ajustado. La forma de reproducir este problema: 1. Use 1600x900 para mostrar en el host 2. Monte ISO a trav\\u00e9s de \u0027Medios virtuales\u0027 en la web de OpenBMC 3. Ejecute el script como se muestra a continuaci\\u00f3n en el host para hacer sha continuamente #!/bin/bash while [ [1] ]; do find /media -type f -printf \u0027\\\"%h/%f\\\"\\\\n\u0027 | xargs sha256sum done 4. Abra KVM en la web de OpenBMC El tama\\u00f1o del bloque de macro capturado es 8x8. Por lo tanto, debemos asegurarnos de que la altura de src-buf est\\u00e9 alineada con 8 para solucionar este problema.\"}]",
      "id": "CVE-2023-52916",
      "lastModified": "2024-12-14T21:15:16.370",
      "published": "2024-09-06T09:15:03.327",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/4c823e4027dd1d6e88c31028dec13dd19bc7b02d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c281355068bc258fd619c5aefd978595bede7bfe\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-28T01:01:17.000Z",
      "cve": "CVE-2023-52916",
      "id": "msrc_CVE-2023-52916",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: aspeed: Fix memory overwrite if timing is 1600x900",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2023-52916.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52916\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-06T09:15:03.327\",\"lastModified\":\"2026-08-04T10:18:48.870\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: aspeed: Fix memory overwrite if timing is 1600x900\\n\\nWhen capturing 1600x900, system could crash when system memory usage is\\ntight.\\n\\nThe way to reproduce this issue:\\n1. Use 1600x900 to display on host\\n2. Mount ISO through \u0027Virtual media\u0027 on OpenBMC\u0027s web\\n3. Run script as below on host to do sha continuously\\n  #!/bin/bash\\n  while [ [1] ];\\n  do\\n\\tfind /media -type f -printf \u0027\\\"%h/%f\\\"\\\\n\u0027 | xargs sha256sum\\n  done\\n4. Open KVM on OpenBMC\u0027s web\\n\\nThe size of macro block captured is 8x8. Therefore, we should make sure\\nthe height of src-buf is 8 aligned to fix this issue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: aspeed: corrige la sobrescritura de memoria si el tiempo es 1600x900 Al capturar 1600x900, el sistema podr\u00eda bloquearse cuando el uso de la memoria del sistema es ajustado. La forma de reproducir este problema: 1. Use 1600x900 para mostrar en el host 2. Monte ISO a trav\u00e9s de \u0027Medios virtuales\u0027 en la web de OpenBMC 3. Ejecute el script como se muestra a continuaci\u00f3n en el host para hacer sha continuamente #!/bin/bash while [ [1] ]; do find /media -type f -printf \u0027\\\"%h/%f\\\"\\\\n\u0027 | xargs sha256sum done 4. Abra KVM en la web de OpenBMC El tama\u00f1o del bloque de macro capturado es 8x8. Por lo tanto, debemos asegurarnos de que la altura de src-buf est\u00e9 alineada con 8 para solucionar este problema.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/platform/aspeed/aspeed-video.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d2b4387f3bdf016e266d23cf657465f557721488\",\"lessThan\":\"4c823e4027dd1d6e88c31028dec13dd19bc7b02d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d2b4387f3bdf016e266d23cf657465f557721488\",\"lessThan\":\"c281355068bc258fd619c5aefd978595bede7bfe\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/platform/aspeed/aspeed-video.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-09T20:43:04.212290Z\",\"id\":\"CVE-2023-52916\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"77F59407-FF9B-4DBC-A5C0-718D2C65872D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6\",\"matchCriteriaId\":\"6747FDB4-EF6B-4019-9232-82D90A3D6E73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4c823e4027dd1d6e88c31028dec13dd19bc7b02d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c281355068bc258fd619c5aefd978595bede7bfe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:22:54+00:00",
      "cve": "CVE-2023-52916",
      "id": "CVE-2023-52916",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: aspeed: Fix memory overwrite if timing is 1600x900",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52916.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T02:27:24Z",
      "cve": "CVE-2023-52916",
      "id": "CVE-2023-52916",
      "initial_release_date": "2024-09-07T03:38:28Z",
      "product_status:known_affected": "474",
      "product_status:known_not_affected": "139",
      "product_status:recommended": "645",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52916",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52916.json",
      "version": "61"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:36:16.639Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52916\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-09T20:43:04.212290Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-09T20:46:40.252Z\"}}], \"cna\": {\"title\": \"media: aspeed: Fix memory overwrite if timing is 1600x900\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is reached through the local V4L2 device node (/dev/video*) via open, VIDIOC_S_DV_TIMINGS, and streaming ioctls on the BMC; the kernel does not process network packets in this driver.\\nAC:L - Any non-8-aligned capture height (e.g. 1600x900) reliably allocates an undersized DMA buffer and the hardware always writes past it; an attacker who can open the device can set such timings and start streaming without depending on conditions outside their control.\\nPR:L - The driver performs no capability checks; access requires only open permission on the V4L2 device (typically video-group membership), not real root or init-namespace admin privileges.\\nUI:N - A local attacker with device access can open the capture device, set undersized timings, and start streaming themselves without any separate victim action.\\nS:U - Impact is memory corruption within the same BMC kernel security authority that hosts the vulnerable driver; this is standard local privilege escalation, not a cross-boundary escape.\\nC:H - The out-of-bounds DMA write is substantial kernel memory corruption (~25KB at 1600x900, more at other non-aligned modes) that can be leveraged for information disclosure primitives.\\nI:H - Hardware DMA performs a large out-of-bounds write of capturable framebuffer data into adjacent coherent DMA/kernel memory, which is exploitable for integrity compromise and control-flow hijacking.\\nA:H - The memory overwrite is documented to crash the system (kernel oops/panic) under realistic OpenBMC KVM capture workloads.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d2b4387f3bdf016e266d23cf657465f557721488\", \"lessThan\": \"4c823e4027dd1d6e88c31028dec13dd19bc7b02d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d2b4387f3bdf016e266d23cf657465f557721488\", \"lessThan\": \"c281355068bc258fd619c5aefd978595bede7bfe\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/media/platform/aspeed/aspeed-video.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/media/platform/aspeed/aspeed-video.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4c823e4027dd1d6e88c31028dec13dd19bc7b02d\"}, {\"url\": \"https://git.kernel.org/stable/c/c281355068bc258fd619c5aefd978595bede7bfe\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: aspeed: Fix memory overwrite if timing is 1600x900\\n\\nWhen capturing 1600x900, system could crash when system memory usage is\\ntight.\\n\\nThe way to reproduce this issue:\\n1. Use 1600x900 to display on host\\n2. Mount ISO through \u0027Virtual media\u0027 on OpenBMC\u0027s web\\n3. Run script as below on host to do sha continuously\\n  #!/bin/bash\\n  while [ [1] ];\\n  do\\n\\tfind /media -type f -printf \u0027\\\"%h/%f\\\"\\\\n\u0027 | xargs sha256sum\\n  done\\n4. Open KVM on OpenBMC\u0027s web\\n\\nThe size of macro block captured is 8x8. Therefore, we should make sure\\nthe height of src-buf is 8 aligned to fix this issue.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.120\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6\", \"versionStartIncluding\": \"5.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:11:59.259Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52916\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:11:59.259Z\", \"dateReserved\": \"2024-08-21T06:07:11.017Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-06T09:07:50.462Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.