CVE-2023-54175

Vulnerability

Overview

In the Linux kernel, the I2C XIIC driver's xiic_xfer() function acquires a runtime power management (PM) reference upon entry. The reference is normally released when the function exits. However, one specific error path in xiic_xfer() returns directly without releasing the PM reference, causing a resource leak [1].

Exploitation and

Impact

This vulnerability affects systems using the I2C XIIC driver, typically embedded platforms where runtime PM is used to manage power consumption. An attacker could potentially trigger this error path repeatedly, leading to exhaustion of runtime PM references. Over time, this could prevent the device from entering low-power states or cause instability, though the impact is primarily resource depletion rather than code execution [2].

Mitigation

The fix ensures that all error paths in xiic_xfer() properly release the runtime PM reference. The patch has been applied to the Linux kernel stable tree and is available in multiple stable versions [3]. Users should update to a patched kernel version to avoid the leak.