CVE-2023-54058

Vulnerability

The Arm Firmware Framework for A-profile (FF-A) driver in the Linux kernel invokes ffa_drv->remove() unconditionally within ffa_device_remove(). The driver registration does not mandate a .remove callback, so a driver can be registered without one. When such a driver is removed (e.g., via rmmod), the kernel attempts to call a NULL function pointer, leading to a kernel NULL pointer dereference [1].

Exploitation

An attacker with the ability to load and unload a malicious or buggy FF-A driver that lacks a .remove callback can trigger this crash. The prerequisite is local access sufficient to insert and remove kernel modules, typically requiring root privileges. No special network position is required; the attack is purely local. The vulnerability manifests during driver detachment, as shown in the call trace in the CVE description [1].

Impact

A successful trigger results in a kernel panic (NULL pointer dereference), causing a denial of service on the system. The crash halts all operations and may require a reboot to recover. No code execution or privilege escalation is indicated in the available sources [1].

Mitigation

The fix, introduced in the upstream Linux kernel, adds a NULL check before calling ffa_drv->remove(). The patches are contained in commits referenced as stable kernel updates [1][2]. System administrators should apply the latest stable kernel updates that include these commits. No specific workaround is documented; the vulnerability is mitigated by ensuring all FF-A drivers provide a .remove callback or by updating to a patched kernel.