CVE-2023-54091

What it actually does

The flaw is a memory leak in drm_client_target_cloned where a duplicated display mode structure allocated via drm_mode_duplicate is never freed, affecting generic fbdev setups across most DRM drivers.

Why it matters to the business

Prolonged operation on affected systems can exhaust kernel memory leading to degraded performance, instability, or crashes that interrupt workloads running the listed kyverno packages on MinimOS; no ransomware association or CISA deadline applies.

How an attack unfolds

An attacker with local access triggers repeated DRM client registration and hotplug events (such as ast_pci_probe paths) that invoke drm_client_modeset_probe and allocate unreleased mode objects, gradually exhausting memory without requiring remote code execution.

How to fix it

Upgrade kyverno-1.12, kyverno-init-container-1.12, kyverno-reports-controller-1.12, kyverno-background-controller-1.12, kyverno-cleanup-controller-1.12 and kyverno-cli-1.12 on MinimOS to version 1.12.7-r2 or later; apply kernel updates that resolve the drm memory leak once available.

How to confirm the fix worked

Verify installed package versions match the fixed releases, reproduce the original kmemleak backtrace in a test environment after upgrade, and confirm absence of unreferenced drm_mode_duplicate objects.

Typical attack path

1. Obtain local access to trigger graphics or fbdev initialization
2. Cause repeated drm_client_register and hotplug sequences
3. Invoke drm_client_target_cloned to allocate dmt_mode objects
4. Allow allocations to accumulate until kernel memory pressure occurs

How to detect it

Search kernel logs and kmemleak output for backtraces containing drm_mode_duplicate, drm_client_target_cloned, drm_client_modeset_probe and drm_fbdev_client_hotplug; inspect for unreferenced objects of size 128 allocated during ast_pci_probe or similar paths.

• drm_mode_duplicate+0x45/0x220
• drm_client_target_cloned.constprop.0+0x27b/0x480
• unreferenced object 0xff11000333089a00 (size 128)

What your security team should do

• Prioritize upgrade of all listed kyverno MinimOS packages to 1.12.7-r2 within standard change windows
• Monitor kernel kmemleak reports for drm_client_target_cloned references until patches are deployed
• Limit local user access on systems using affected DRM drivers to reduce leak triggers