CVE-2023-54257

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: macb: fix a memory corruption in extended buffer descriptor mode

For quite some time we were chasing a bug which looked like a sudden

permanent failure of networking and mmc on some of our devices.

The bug was very sensitive to any software changes and even more to

any kernel debug options.

Finally we got a setup where the problem was reproducible with

CONFIG_DMA_API_DEBUG=y and it revealed the issue with the rx dma:

[ 16.992082] ------------[ cut here ]------------

[ 16.996779] DMA-API: macb ff0b0000.ethernet: device driver tries to free DMA memory it has not allocated [device address=0x0000000875e3e244] [size=1536 bytes]

[ 17.011049] WARNING: CPU: 0 PID: 85 at kernel/dma/debug.c:1011 check_unmap+0x6a0/0x900

[ 17.018977] Modules linked in: xxxxx

[ 17.038823] CPU: 0 PID: 85 Comm: irq/55-8000f000 Not tainted 5.4.0 #28

[ 17.045345] Hardware name: xxxxx

[ 17.049528] pstate: 60000005 (nZCv daif -PAN

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References