CVE-2023-53617

What it actually does

Missing kfree after kstrdup in error path of aspeed socinfo driver causes memory leak.

Why it matters to the business

Gradual memory exhaustion on affected Linux systems can lead to degraded performance or crashes, with moderate urgency due to low EPSS and no KEV listing despite high ecosystem prevalence of the kernel.

How an attack unfolds

An attacker with local access triggers the error path in socinfo initialization repeatedly to exhaust memory without needing elevated privileges beyond local user; unrelated listed threat actors target similar kernel privilege issues but this flaw is not actively exploited per available data.

How to fix it

Upgrade to a kernel containing the fix; for ruby-saml users the listed package should be updated to version 1.12.3 where applicable in mixed environments.

How to confirm the fix worked

Confirm kernel source includes the kfree addition in socinfo error handling; check running kernel version against fixed releases and review memory usage patterns post-update.

Typical attack path

1. Obtain local shell on target system
2. Trigger socinfo code paths that hit the error handling branch
3. Repeat to accumulate leaked memory allocations
4. Monitor for system instability or OOM conditions

How to detect it

Review kernel logs for repeated socinfo initialization failures; inspect memory leak detectors or slabinfo for unusual aspeed allocations; no specific threat actor IOCs tied to this CVE.

What your security team should do

• Prioritize kernel updates on all Aspeed-based systems within standard patching cycles
• Monitor EPSS trend for any increase above 0.01
• Audit local user access controls to limit exposure