CVE-2023-54024

Vulnerability

CVE-2023-54024 is a memory leak vulnerability in the Linux kernel's KVM subsystem, specifically in the coalesced MMIO device handling. The root cause is that when kvm_io_bus_unregister_dev() fails during the unregistration of a coalesced MMIO device, the target device object is not freed, leading to a memory leak. The kernel code explicitly notes that kvm_io_bus_unregister_dev() does not destroy the target device, but the error path in kvm_vm_ioctl_register_coalesced_mmio was missing the necessary cleanup [1][2].

Exploitation

An attacker with access to a VM and the ability to issue KVM_REGISTER_COALESCED_MMIO ioctl calls can trigger this leak. By repeatedly registering and then attempting to unregister coalesced MMIO devices in a way that causes the unregistration to fail, the attacker can cause the kernel to leak memory. The attack requires local access to the host or a guest VM with sufficient privileges to interact with the KVM device file descriptor.

Impact

Successful exploitation leads to a kernel memory leak, which can exhaust system memory over time, potentially causing a denial of service (DoS) condition on the host. The leak is demonstrated in the bug report with a 64-byte object being leaked per failure, and the kernel's leak checker confirms the issue [1][2].

Mitigation

The fix is included in Linux kernel stable updates. Users should apply the latest kernel patches from their distribution. The commit references [1] and [2] provide the corrected code that ensures the target device is freed on unregistration failure.