CVE-2023-54057

What it actually does

Unbounded sscanf() call in parse_ivrs_acpihid allows overflow of the acpiid buffer when processing the ivrs_acpihid command-line parameter in AMD IOMMU code.

Why it matters to the business

On affected AMD Linux systems, an attacker able to influence boot parameters could trigger a kernel memory corruption that may lead to crashes, privilege escalation, or full system compromise; the large number of downstream packages increases exposure across container and cloud environments.

How an attack unfolds

An attacker supplies a crafted ivrs_acpihid= value longer than the destination buffer on the kernel command line (via bootloader configuration or physical access); the missing width specifier in sscanf() causes the copy to exceed buffer bounds, corrupting adjacent kernel memory.

How to fix it

Upgrade the Linux kernel to commit 5e97dc748d13fad582136ba0c8cec215c7aeeb17 or later; for fluent-operator, fluent-watcher and related packages update to version 3.4.0-r1 or newer.

How to confirm the fix worked

Verify the running kernel contains commit 5e97dc748d13fad582136ba0c8cec215c7aeeb17; confirm fluent-operator/fluent-watcher images report version 3.4.0-r1 or higher; test boot with a long ivrs_acpihid value and observe absence of overflow.

Typical attack path

1. Obtain ability to set or modify kernel boot parameters
2. Append an excessively long acpihid string to the ivrs_acpihid option
3. Trigger kernel initialization of the AMD IOMMU subsystem
4. Exploit resulting memory corruption for code execution or denial of service

How to detect it

Review bootloader configuration files and kernel boot logs for unusually long ivrs_acpihid values; examine dmesg or early boot output for signs of memory corruption near AMD IOMMU initialization; correlate with any post-boot anomalies on systems that have not yet been updated.

What your security team should do

• Prioritize kernel updates on all AMD-based systems within the CISA remediation window if applicable
• Restrict ability to modify bootloader configuration to privileged administrators only
• Scan container registries for fluent-operator images older than 3.4.0-r1 and replace them
• Monitor EPSS trend; reassess if score rises above 0.01