CVE-2023-52451

What it actually does

Out-of-bounds read in dlpar_memory_remove_by_index() when DRC index lookup fails, leaving the cursor pointing past the end of the drmem lmb array; subsequent dereference in a debug print triggers slab-out-of-bounds access.

Why it matters to the business

Local denial-of-service or information disclosure on PowerPC Linux systems performing dynamic memory hot-remove operations; kernel stability risk during maintenance or cloud orchestration workloads.

How an attack unfolds

An attacker with local access invokes the DLPAR memory hot-remove path via sysfs with a non-existent DRC index; the failed lookup leaves a pointer one element beyond the allocated array, and the debug statement dereferences it, causing a KASAN-detected out-of-bounds read that can be turned into a crash or controlled read primitive.

How to fix it

Apply the upstream fix in commit bb79613a9a704469ddb8d6c6029d532a5cea384c or later; rebuild and deploy the patched kernel on all PowerPC pseries systems; verify the change is present before rebooting into production.

How to confirm the fix worked

Confirm the fixed commit is in the running kernel source tree; re-run KASAN-enabled tests that previously reproduced the slab-out-of-bounds on invalid DRC indices; ensure pr_debug path now only dereferences valid entries.

Typical attack path

1. Obtain local shell on affected PowerPC Linux system
2. Write an invalid DRC index to the dlpar sysfs attribute
3. Trigger dlpar_memory_remove_by_index() via handle_dlpar_errorlog
4. Observe or exploit the resulting slab-out-of-bounds read

How to detect it

Search kernel logs and dmesg for KASAN slab-out-of-bounds reports referencing dlpar_memory or pseries-hotplug-mem; look for the message "Failed to hot-remove memory at" followed by address 0 or unexpected values; correlate with sysfs writes to dlpar attributes.

• BUG: KASAN: slab-out-of-bounds in dlpar_memory
• pseries-hotplug-mem: Attempting to hot-remove LMB, drc index
• pseries-hotplug-mem: Failed to hot-remove memory at 0

What your security team should do

• Prioritize patching PowerPC systems within the next maintenance window due to high local CVSS score
• Restrict unprivileged access to dlpar sysfs interfaces until patched
• Enable KASAN or similar memory debugging on test PowerPC instances to validate the fix
• Monitor kernel changelogs for backports into stable and distribution kernels