CVE-2023-54183

Vulnerability

Overview

CVE-2023-54183 is a resource leak vulnerability in the Linux kernel's Video for Linux 2 (V4L2) subsystem, specifically in the v4l2_fwnode_parse_link() function. The function parses firmware node links for video devices. The root cause is improper error handling: when fwnode_graph_get_remote_endpoint() fails, the code previously only called fwnode_handle_put() on the already-NULL fwnode pointer, which is a no-op. This meant the reference taken earlier by fwnode_graph_get_port_parent() was never released, leading to a reference count leak. Additionally, the function did not handle failures of fwnode_graph_get_port_parent() itself, which could leave the system in an inconsistent state.

Exploitation and

Attack Surface

To exploit this vulnerability, an attacker would need to trigger a failure in fwnode_graph_get_remote_endpoint() while the kernel is parsing a V4L2 firmware node link. This could be achieved by providing a malformed or incomplete device tree or ACPI table that causes the endpoint lookup to fail. The attack requires local access to the system or the ability to influence firmware node data (e.g., via a malicious peripheral device). No authentication is needed beyond the ability to trigger the parsing, which may occur during device enumeration or hotplug events.

Impact

If successfully triggered, the reference leak causes the kernel to hold an extra reference on a firmware node object indefinitely. Repeated exploitation could exhaust kernel memory, leading to a denial-of-service (DoS) condition. The vulnerability does not directly allow code execution or privilege escalation, but memory exhaustion can crash the system or make it unresponsive.

Mitigation

The fix was applied in Linux kernel stable releases via commits [1], [2], [3], and [4]. The patch adds proper error handling: it releases the reference from fwnode_graph_get_port_parent() when fwnode_graph_get_remote_endpoint() fails, and checks for failures of fwnode_graph_get_port_parent() itself. Users should update to a kernel version containing these commits. No workaround is available other than applying the patch.