CVE-2023-54320

Vulnerability

Analysis

In the Linux kernel's platform/x86/amd/pmc driver, the function amd_pmc_stb_debugfs_open_v2() allocates a buffer for STB debug data. If the subsequent call to amd_pmc_send_cmd() fails, the buffer is not freed, causing a memory leak [1].

Exploitation

Exploitation

The vulnerability is reachable only when the STB debug mechanism is enabled. An attacker would need local access to the system and the ability to trigger the debugfs open operation. No special privileges are required beyond normal user access to debugfs interfaces if enabled. The failure condition can be induced by external factors like hardware unresponsive hardware.

Impact

Each failed call leaks a small buffer. While not directly exploitable for code execution, repeated triggers could exhaust memory, leading to denial of service.

Mitigation

The fix, included in Linux kernel stable updates, adds a kfree(buf) on the error path before the function returns [1]. Users should apply the most recent stable kernel patch or update to a version containing the commit.