CVE-2023-52457

What it actually does

The flaw permits a use-after-free in the 8250 OMAP serial driver when pm_runtime_resume_and_get fails during .remove(), because the error return skips serial8250_unregister_port and leaves UART state accessible after the device is removed anyway.

Why it matters to the business

Local attackers on affected Linux kernels can trigger memory corruption that may lead to privilege escalation or kernel crashes, risking data exposure and service disruption on servers, embedded devices, and desktops running vulnerable kernels.

How an attack unfolds

An attacker with local code execution obtains a handle to an OMAP serial device, forces a runtime-PM failure during module unload or device removal, and then re-uses the dangling UART port structure before the kernel reclaims it, achieving arbitrary read/write in kernel memory.

How to fix it

Upgrade the Linux kernel to a fixed release such as 5.4.268 or later, or apply commit b502fb43f7fb55aaf07f6092ab44657595214b93 and rebuild. Reboot after installation and verify the running kernel version contains the fix.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or is at least version 5.4.268; inspect dmesg for the updated error message path instead of an error return from .remove(); run regression tests that exercise serial port module load/unload under PM failure conditions.

Typical attack path

1. Gain local user or container access on the target system
2. Locate or create an 8250 OMAP serial port instance
3. Induce pm_runtime_resume_and_get failure during driver removal
4. Reuse the unregistered port structure to corrupt kernel memory
5. Escalate privileges or cause denial of service

How to detect it

Review kernel logs for remove-callback error messages or serial8250_unregister_port calls; correlate with unexpected UART port reuse or use-after-free warnings in dmesg; examine audit logs for local processes triggering serial device removal.

What your security team should do

• Prioritize kernel updates on all systems exposing serial devices or running affected stable trees
• Restrict unprivileged local access where feasible until patches are deployed
• Monitor vendor advisories for backported fixes in distribution kernels
• Include kernel version checks in asset inventory and vulnerability scanning