CVE-2023-53852

What it actually does

Memory leak in nvme_ctrl_dhchap_secret_store() where dhchap_secret allocations via __kmalloc are not freed on return paths, leaving unreferenced 64-byte kernel objects containing DH-CHAP secret data.

Why it matters to the business

Repeated writes to NVMe DH-CHAP sysfs attributes on affected Linux kernels can slowly exhaust kernel memory, risking system instability or denial of service in storage-heavy environments; prevalence in Linux distributions increases exposure for servers and embedded devices.

How an attack unfolds

An attacker with local write access to an NVMe controller's sysfs dhchap_secret attribute repeatedly invokes kernfs_fop_write_iter which calls nvme_ctrl_dhchap_secret_store, triggering fresh __kmalloc allocations without corresponding frees and producing detectable kmemleak objects.

How to fix it

Upgrade the Linux kernel to a version containing commit 2e9b141307554521d60fecf6bf1d2edc8dd0181d; for Ubuntu packages apply the listed fixed versions such as 2.6.3-1~ubuntu18.04.1 or later equivalents for each release.

How to confirm the fix worked

Boot the patched kernel, exercise dhchap_secret writes, and confirm absence of matching unreferenced objects in /sys/kernel/debug/kmemleak; verify the exact commit or package version is present.

Typical attack path

1. Gain local access or compromise a process able to write NVMe sysfs attributes
2. Locate target NVMe controller sysfs path under /sys/class/nvme
3. Repeatedly write DH-CHAP secret strings such as 'DHHC-1:00:...' to dhchap_secret
4. Observe gradual increase in unreferenced kernel memory via kmemleak or slabinfo

How to detect it

Scan kmemleak output and kernel logs for backtraces containing nvme_ctrl_dhchap_secret_store together with hex dumps beginning 'DHHC-1:00:'; correlate with process names performing repeated writes to NVMe sysfs paths.

• nvme_ctrl_dhchap_secret_store
• DHHC-1:00:nxr5Kg
• unreferenced object.*size 64.*comm "check"
• __kmalloc.*nvme_core

What your security team should do

• Prioritize kernel updates on all systems exposing NVMe devices with DH-CHAP
• Enable kmemleak or similar kernel memory debugging in test and production where feasible
• Restrict write access to NVMe sysfs attributes via SELinux or DAC to least-privilege processes
• Monitor EPSS and KEV status for any future changes indicating increased exploitability