CVE-2023-52859

What it actually does

Use-after-free in HiSilicon uncore PMU context when cpuhp_state_remove_instance triggers migration callbacks after failed PMU registration leaves the context unallocated.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or escalate privileges, disrupting services and requiring urgent patching of production kernels with high ecosystem prevalence.

How an attack unfolds

An attacker with local access triggers deliberate failure during uncore PMU registration; the error path invokes cpuhp_state_remove_instance which executes notifiers on an invalid context, resulting in use-after-free that can be leveraged for memory corruption.

How to fix it

Update the Linux kernel to commit 0e1e88bba286621b886218363de07b319d6208b2 or later stable releases containing the fix; replace cpuhp_state_remove_instance with cpuhp_state_remove_instance_nocalls in the error path.

How to confirm the fix worked

Verify the running kernel contains commit 0e1e88bba286621b886218363de07b319d6208b2; confirm PMU registration error paths no longer invoke notifier callbacks; test registration failure scenarios in a lab environment.

Typical attack path

1. Obtain local user access on a Linux system with HiSilicon uncore PMU support
2. Craft conditions to force PMU registration failure
3. Trigger the error-handling path that calls cpuhp_state_remove_instance
4. Exploit the resulting use-after-free for memory corruption or code execution

How to detect it

Review kernel logs for PMU registration failures followed by unexpected CPU hotplug or context migration events; inspect for oops or panic traces referencing uncore PMU offline callbacks.

What your security team should do

• Prioritize kernel upgrades on all HiSilicon-based systems within standard change windows
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict local access where feasible until patches are deployed
• Include the fixed commit hash in automated kernel version checks