CVE-2023-53757

What it actually does

A reference count leak occurs in the mvebu_gicp_probe function when of_irq_find_parent() is called without a corresponding of_node_put(), preventing proper release of device tree nodes.

Why it matters to the business

On affected Linux kernel versions in Ubuntu Pro 14.04 for Azure, repeated loading of the driver can lead to gradual memory exhaustion and potential system instability or crashes over time.

How an attack unfolds

An attacker would need to trigger repeated probe operations for the affected IRQ chip, which is unlikely in normal operation and not a typical remote attack vector; the issue was a coding oversight rather than an intentional exploit path.

How to fix it

Upgrade to the fixed version 4.15.0-1123.136~14.04.1 or later for linux-azure on Ubuntu Pro 14.04 LTS.

How to confirm the fix worked

Verify the kernel version is at or above the fixed version and check for absence of the refcount leak in the probe function.

Typical attack path

1. Trigger driver probe through hardware or module load
2. Cause repeated calls without node release leading to leak accumulation

How to detect it

Examine kernel logs for signs of memory pressure or leaks related to device tree nodes; no specific post-exploitation indicators since the issue is a leak not an active compromise.

What your security team should do

• Apply the kernel update immediately if running affected versions
• Monitor for any memory-related issues on systems using mvebu-gicp IRQ chip
• Review device tree configurations for affected hardware