CVE-2023-52617

What it actually does

Use-after-free in switchtec stdev_release() after surprise PCI hot remove allows iowrite32() and dma_free_coherent() to access unmapped MMIO and a stale pdev pointer, producing a fatal page fault.

Why it matters to the business

Systems using affected Switchtec hardware may experience unexpected kernel crashes and reboots during device removal or driver unload, disrupting availability and requiring manual intervention or reboot.

How an attack unfolds

An attacker with physical or administrative access triggers a surprise hot remove of the PCI device while a user-space process still holds the switchtec character device open; on subsequent close the release path dereferences freed mappings and causes a kernel panic.

How to fix it

Apply the upstream fix (commit d8c293549946ee5078ed0ab77793cec365559355) or later stable kernels; rebuild and reboot with a patched kernel image. For packaged distributions, install the corrected mariadb-connector-odbc or equivalent kernel package that includes the fix.

How to confirm the fix worked

Confirm the running kernel contains commit d8c293549946ee5078ed0ab77793cec365559355 or later; attempt the hot-remove reproduction script on test hardware and verify no page fault occurs; review dmesg for absence of switchtec-related oops after removal.

Typical attack path

1. Obtain ability to trigger PCI hot remove (physical access, management interface, or root privileges)
2. Ensure a process holds the switchtec cdev open
3. Perform surprise removal while the device is still referenced
4. Trigger process exit or close to invoke stdev_release()
5. Kernel page fault occurs in DMA shutdown code

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or page-fault messages referencing switchtec, stdev_release, iowrite32, or dma_free_coherent around the time of device removal events.

What your security team should do

• Prioritize patching kernel packages on systems exposing Switchtec devices
• Schedule maintenance windows for systems that support live device removal
• Add kernel crash and oops monitoring to detect similar issues
• Limit unprivileged access to PCI hot-plug interfaces where feasible