CVE-2023-53703

Root

Cause In the Linux kernel's AMD SFH (Sensor Fusion Hub) driver, the function float_to_int() in amd_sfh_desc.c performs bit-shift operations using exp and shift values derived from sensor data without proper validation. As shown in the crash trace [1], a shift exponent of 104 exceeds the maximum allowed for a 64-bit type, triggering a UBSAN shift-out-of-bounds error. This occurs when the driver processes input reports from the sensor hardware.

Exploitation

An attacker with physical or local access could potentially trigger this condition by connecting a malicious or malformed AMD SFH sensor device, or by manipulating sensor data in a way that causes the driver to compute out-of-range shift values. No special privileges are required to trigger the vulnerable code path, as it runs in the context of a kernel workqueue (amd_sfh_work_buffer) during normal sensor data handling [1].

Impact

The vulnerability causes a kernel panic or system crash due to the UBSAN handler, leading to a denial of service (DoS). The crash trace explicitly shows the system halting with a UBSAN warning and a call trace ending in float_to_int.cold [1]. While no privilege escalation or data corruption is indicated, the instability could disrupt system availability.

Mitigation

The fix adds a condition to validate the shift range before performing the operation, preventing the out-of-bounds shift. The patch was committed to the stable kernel tree and is included in subsequent releases [1]. Users should update their kernel to a version containing this fix (e.g., 6.4 or later). No workaround is available for unpatched systems.