CVE-2023-54188

Vulnerability

Overview

In the Linux kernel's Apple ADMAC (Apple DMA Controller) driver, a memory leak exists in the terminate_all function. The driver maintains lists of submitted and issued DMA descriptors, and a pointer to the currently executing descriptor (current_tx). When terminate_all is called, it correctly queues descriptors from the 'submitted' and 'issued' lists for freeing, but the current_tx descriptor is removed from the 'issued' list when it becomes the active descriptor, causing it to be missed during cleanup [1].

Exploitation and

Impact

An attacker with the ability to trigger DMA termination (e.g., by closing a file descriptor or unloading a driver) can repeatedly cause this memory leak. Over time, this leads to kernel memory exhaustion, potentially resulting in a denial-of-service (DoS) condition. No special privileges are required beyond the ability to interact with the ADMAC subsystem, which may be accessible to unprivileged users depending on device permissions.

Mitigation

The fix, introduced in Linux kernel commit d9503be5a100, explicitly queues the current_tx descriptor for freeing in terminate_all, preventing the leak. Users should apply the latest stable kernel updates to address this vulnerability [1].