CVE-2023-53814: In the Linux kernel, the following vulnerability has been resolved: PCI: Fix dropping valid root bus resources with .end = zero On r8a7791/koelsch: kmemleak: 1…

PriorityP421low5.5

EPSS

0.18%

8.1th percentile

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix dropping valid root bus resources with .end = zero

On r8a7791/koelsch:

kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
# cat /sys/kernel/debug/kmemleak
unreferenced object 0xc3a34e00 (size 64):
comm "swapper/0", pid 1, jiffies 4294937460 (age 199.080s)
hex dump (first 32 bytes):
b4 5d 81 f0 b4 5d 81 f0 c0 b0 a2 c3 00 00 00 00 .]...]..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[] __kmalloc+0xf0/0x140
[] resource_list_create_entry+0x18/0x38
[] pci_add_resource_offset+0x20/0x68
[] devm_of_pci_get_host_bridge_resources.constprop.0+0xb0/0x390

When coalescing two resources for a contiguous aperture, the second
resource is enlarged to cover the full contiguous range, while the first
resource is marked invalid. This invalidation is done by clearing the
flags, start, and end members.

When adding the initial resources to the bus later, invalid resources are
skipped. Unfortunately, the check for an invalid resource considers only
the end member, causing false positives.

E.g. on r8a7791/koelsch, root bus resource 0 ("bus 00") is skipped, and no
longer registered with pci_bus_insert_busn_res() (causing the memory leak),
nor printed:

pci-rcar-gen2 ee090000.pci: host bridge /soc/pci@ee090000 ranges:
pci-rcar-gen2 ee090000.pci: MEM 0x00ee080000..0x00ee08ffff -> 0x00ee080000
pci-rcar-gen2 ee090000.pci: PCI: revision 11
pci-rcar-gen2 ee090000.pci: PCI host bridge to bus 0000:00
-pci_bus 0000:00: root bus resource [bus 00]
pci_bus 0000:00: root bus resource [mem 0xee080000-0xee08ffff]

Fix this by only skipping resources where all of the flags, start, and end
members are zero.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.20-1 (bookworm)	linux 6.1.20-1 (bookworm)
linux	linux	—	—
linux	linux	>= 7c3855c423b17f6ca211858afb0cef20569914c7 < fe6a1fbe83f5b23d7db93596b793561230f06b40	fe6a1fbe83f5b23d7db93596b793561230f06b40
linux	linux	>= 7c3855c423b17f6ca211858afb0cef20569914c7 < 7e6f2714d93cdf977b6124a80af2cf0e14e2d407	7e6f2714d93cdf977b6124a80af2cf0e14e2d407
linux	linux	>= 7c3855c423b17f6ca211858afb0cef20569914c7 < 9d8ba74a181b1c81def21168795ed96cbe6f05ed	9d8ba74a181b1c81def21168795ed96cbe6f05ed
linux	linux	>= fd168b7d1d7cfc61cea561b1e3cc47aefc9e8f19 < e4af080f3ef6a65b0d702988c2471a47c9ae2cc0	e4af080f3ef6a65b0d702988c2471a47c9ae2cc0
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 5.16.0 < 6.1.16	6.1.16
linux	linux_kernel	>= 6.2.0 < 6.2.3	6.2.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.