CVE-2023-52559

What it actually does

iommu_suspend() syscore callback runs with IRQs disabled yet performs GFP_KERNEL allocation, which may re-enable interrupts and trigger timekeeping warnings plus syscore_suspend failures during hibernation.

Why it matters to the business

Systems may experience intermittent suspend or hibernation failures, leading to unexpected wake-ups, data loss risk on laptops, and reduced reliability for power-management dependent workloads.

How an attack unfolds

An attacker with local access triggers a suspend or hibernation sequence (for example via rtcwake or power-management scripts) while the buggy iommu_suspend path executes, causing the kernel to warn and potentially abort the suspend operation.

How to fix it

Update to a kernel containing the fix that removes the dynamic allocation in iommu_suspend (only four words of storage are required). Reboot after installation and verify suspend/hibernation succeeds without the ktime_get or syscore_suspend warnings.

How to confirm the fix worked

Confirm the running kernel version contains the upstream commit that eliminates GFP_KERNEL from iommu_suspend; trigger multiple suspend/hibernate cycles and verify absence of the listed WARNING traces in dmesg.

Typical attack path

1. Obtain local user access on affected kernel
2. Invoke suspend or hibernation (power button, rtcwake, systemctl hibernate)
3. iommu_suspend runs under IRQ-disabled context
4. GFP_KERNEL allocation re-enables interrupts
5. Kernel emits warnings and suspend may fail or leave system unstable

How to detect it

Search kernel logs (dmesg, journalctl) for the exact WARNING strings mentioning iommu_suspend, ktime_get, and syscore_suspend during suspend or hibernate attempts; correlate with process names such as rtcwake or systemctl.

• WARNING: CPU.*PID.*at kernel/time/timekeeping.c.*ktime_get
• Interrupts enabled after iommu_suspend
• WARNING: CPU.*PID.*at drivers/base/syscore.c.*syscore_suspend
• Calling iommu_suspend

What your security team should do

• Prioritize kernel update on all systems that perform frequent suspend/hibernate operations
• Add the provided detection IOCs to SIEM rules for post-patch validation
• Test hibernation on representative hardware before mass deployment