CVE-2023-53567
Description
An incorrect error handling flaw was found in the Linux kernel's Qualcomm SPI driver in the device removal path. A local privileged user who triggers device removal when the hardware fails to wake can cause DMA resources to leak permanently, as the driver returns early from the cleanup callback without releasing allocated resources. This leads to resource exhaustion and denial of service through repeated device removal operations or system reboot scenarios.
Statement
The bug occurs in the platform driver's remove callback, which is invoked during device unbinding or system shutdown. When the code attempts to wake the device and that operation fails, it returns immediately without proceeding to DMA resource cleanup. Since remove callbacks are never retried, these resources remain allocated indefinitely. This creates a permanent memory leak that accumulates across device hotplug cycles or module unload/reload sequences. Triggering requires the ability to unbind devices or unload modules, typically requiring root privileges or specific udev configurations.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.4 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | High | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other)
An attacker that can influence the allocation of resources that are not properly maintained could deplete the available resource pool and prevent all other processes from accessing the same type of resource.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
