CVE-2023-53999

What it actually does

Memory leak in mlx5e TC flow rule handling where int_port object reference count is incremented via mlx5e_tc_int_port_get() for post_act rules involving internal port forwarding over tunnels (e.g., with CT new state offload) but never decremented because mlx5e_tc_int_port_put() is not called, preventing object free and causing kmemleak.

Why it matters to the business

Gradual memory exhaustion on affected Linux systems using mlx5 network adapters with complex TC rules can lead to performance degradation, instability, or crashes; the issue has low exploitation likelihood but requires patching to avoid long-term resource leaks in high-traffic environments.

How an attack unfolds

An attacker with ability to install or influence traffic control classifiers (e.g., via cls_flower) sets up flow rules that split across post_act tables and forward from internal ports over tunnels under conditions allowing CT new state offload, repeatedly triggering allocation without cleanup.

How to fix it

Update the Linux kernel to a version containing the fix that moves int_port cleanup into the flow attribute free helper; for ezsystems/ezplatform-admin-ui update to version 2.3.38 or later.

How to confirm the fix worked

After patching, run kmemleak scans or monitor /sys/kernel/debug/kmemleak for absence of int_port leaks during TC rule operations; verify mlx5_core module version matches the fixed release.

Typical attack path

1. Install or modify TC flower filters that create FDB flows involving internal ports and tunnel encapsulation
2. Ensure CT new state offload is permitted to trigger post_act rule creation
3. Repeatedly add/remove such rules to accumulate unreleased int_port objects
4. Monitor for memory growth until system impact occurs

How to detect it

Inspect kernel logs for kmemleak reports referencing mlx5e_tc_int_port_get and unreferenced int_port objects; review netlink and tc filter addition events in audit logs for unusual post_act rule patterns; no ransomware or known APT usage reported.

What your security team should do

• Prioritize kernel upgrade on systems with mlx5 adapters and active TC offload configurations due to 309 days since publication
• Review and simplify complex TC rules involving internal ports and conntrack to reduce exposure surface
• Enable kmemleak or slab accounting monitoring in production to detect similar leaks early
• Track EPSS trend (currently low but rising 7%) for any increase in exploit maturity