CVE-2023-54323

Vulnerability

Overview

CVE-2023-54323 is a race condition in the Linux kernel's CXL PMEM subsystem, specifically in the cxl_pmem driver. The bug occurs during concurrent module load/unload operations (e.g., a loop of modprobe cxl_pci insertions and removals), leading to a NULL pointer dereference in cxl_internal_send_cmd() [1]. The root cause is that the asynchronous bottom half of nvdimm device registration can run after the CXL context required for cxl_pmem_ctl() has already been torn down.

Exploitation

Mechanism

No special privileges are required; an attacker with the ability to load and unload kernel modules or trigger device hotplug events on a system using CXL persistent memory (e.g., through administrative access) can exploit this race. The vulnerability is triggered by a specific temporal ordering: the nvdimm registration (async) outlives the CXL driver removal, so when both the driver and its underlying CXL objects are already freed.

Impact

A successful exploit causes a kernel NULL pointer dereference, leading to a system crash (denial of service). The crash trace shows the failure propagates from cxl_pmem_ctl through nvdimm_get_config_data and finally into the nvdimm probe path.

Mitigation

Status

The fix, provided in kernel commits [1][2][3], introduces a synchronous registration path for nvdimm devices. This ensures that the registration completes before the CXL driver context can be removed, avoiding the race. Users should apply the patch or update to a kernel version containing the fix.