CVE-2023-54235

Vulnerability

CVE-2023-54235 is a race condition in the Linux kernel's PCI Data Object Exchange (DOE) subsystem. The bug occurs because destroy_work_on_stack() was called after signaling completion in the calling thread, creating thread, creating a race between the destruction of the work struct and its use by the workqueue. This can lead to a use-after-free condition where the work struct is accessed after it has been freed.

Exploitation

An attacker would need to trigger the DOE functionality on a PCI device, which requires local access to the system and the ability to interact with PCI devices. The race window is narrow, but a local attacker could potentially exploit this to corrupt memory or cause a denial of service.

Impact

Successful exploitation could lead to a system crash (denial of service) or, in more severe cases, arbitrary code execution in kernel context. The vulnerability was observed to cause a debug object splat warning, indicating memory corruption.

Mitigation

The fix, committed in the Linux kernel moves the destroy_work_on_stack() call to after the work item signals completion, ensuring the work struct remains valid until the workqueue is done with it. Users should apply the stable kernel updates containing this fix [1][2].