CVE-2023-53446

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free

Struct pcie_link_state->downstream is a pointer to the pci_dev of function

0. Previously we retained that pointer when removing function 0, and

subsequent ASPM policy changes dereferenced it, resulting in a

use-after-free warning from KASAN, e.g.:

# echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove

# echo powersave > /sys/module/pcie_aspm/parameters/policy

BUG: KASAN: slab-use-after-free in pcie_config_aspm_link+0x42d/0x500

Call Trace:

kasan_report+0xae/0xe0

pcie_config_aspm_link+0x42d/0x500

pcie_aspm_set_policy+0x8e/0x1a0

param_attr_store+0x162/0x2c0

module_attr_store+0x3e/0x80

PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM

Control value in all functions of multi-function devices.

Disable ASPM and free the pcie_link_state when any child function is

removed so we can discard the dangling pci

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References