CVE-2023-52576

What it actually does

Use-after-free in memblock_isolate_range() triggered when ima_free_kexec_buffer() executes after the memblock allocator has been torn down, manifesting as a BUG under KASAN or KFENCE from the idle task and resulting in kernel panic.

Why it matters to the business

Systems performing kexec operations with IMA enabled risk unexpected kernel crashes during late boot or shutdown phases, leading to unplanned downtime and potential loss of forensic evidence on affected Linux deployments.

How an attack unfolds

An attacker with local access or the ability to influence kexec/IMA buffer handling can trigger the late call to ima_free_kexec_buffer() after memblock teardown; the resulting use-after-free is primarily a denial-of-service vector that panics the kernel rather than enabling code execution.

How to fix it

Upgrade the Linux kernel to the commit eef16bfdb212da60f5144689f2967fb25b051a2b or later stable releases that replace the call with memblock_free_late(); apply vendor-supplied kernel updates as soon as they are available.

How to confirm the fix worked

Confirm the presence of the fix by checking that ima_free_kexec_buffer() now invokes memblock_free_late(); boot with KASAN or KFENCE enabled and verify absence of BUG reports from the idle task during kexec-related operations.

Typical attack path

1. Obtain local execution or control over kexec/IMA paths on a target system
2. Trigger kexec buffer allocation and subsequent free after memblock allocator teardown
3. Cause memblock_isolate_range() to operate on freed memory under KASAN/KFENCE instrumentation
4. Force idle-task BUG and kernel panic

How to detect it

Inspect kernel logs and crash dumps for BUG reports originating from the idle task involving memblock_isolate_range() or ima_free_kexec_buffer(); correlate with kexec or IMA activity around boot or shutdown.

What your security team should do

• Prioritize kernel updates on all systems that use IMA with kexec
• Monitor for vendor backports of eef16bfdb212da60f5144689f2967fb25b051a2b
• Test patched kernels under KASAN/KFENCE before broad deployment
• Review boot and shutdown logs for any prior idle-task BUG signatures