CVE-2023-54024

What it actually does

Memory leak occurs in KVM when kvm_io_bus_unregister_dev fails for a coalesced MMIO device; the device object allocated via kzalloc is never freed, leaving unreferenced kernel memory.

Why it matters to the business

Over time, repeated triggering can exhaust kernel memory in virtualized hosts, risking instability or denial of service for workloads relying on KVM; low urgency given age and minimal observed exploitation.

How an attack unfolds

An attacker with local access issues repeated KVM ioctls to register coalesced MMIO regions in a manner that causes unregistration to fail, accumulating leaked kernel objects without triggering any external network activity.

How to fix it

Upgrade affected packages to the fixed versions: opensearch-2 and all listed variants to 2.19.1-r5 or later; apply equivalent upstream kernel patches that ensure device destruction on unregistration failure.

How to confirm the fix worked

Confirm package versions match or exceed 2.19.1-r5 for all listed OpenSearch components; verify absence of the described kzalloc backtrace in kernel leak reports after applying updates.

Typical attack path

1. Gain local shell or container access on a KVM host
2. Invoke kvm_vm_ioctl_register_coalesced_mmio via the KVM device file descriptor
3. Force failure paths in kvm_io_bus_unregister_dev
4. Repeat to amplify the leak until memory pressure occurs

How to detect it

Search kernel logs and memory-leak checkers for unreferenced objects allocated from kvm_vm_ioctl_register_coalesced_mmio; monitor for repeated ioctl patterns from untrusted processes on KVM hosts.

What your security team should do

• Prioritize patching all listed OpenSearch packages to 2.19.1-r5 within standard maintenance windows
• Review KVM hosts for memory-leak monitoring and set alerts on sustained kmalloc growth
• Audit local access controls to KVM device nodes to reduce attack surface