CVE-2023-54101

What it actually does

The hash_for_each_possible() loop in the Xilinx SoC driver dereferences eve_data after it has been freed inside the loop body, resulting in a classic use-after-free condition on the list iterator.

Why it matters to the business

Systems running affected Kubernetes or Linux kernel versions face elevated risk of kernel crashes, memory corruption, or potential privilege escalation; the large number of downstream package variants increases operational patching burden across container and host fleets.

How an attack unfolds

An attacker with the ability to trigger the vulnerable hash iteration path in the xilinx soc driver causes the kernel to dereference a previously freed eve_data structure, leading to memory corruption that may be leveraged for denial of service or code execution.

How to fix it

Upgrade to fixed versions: kubernetes (Debian:11/12/13) 1.20.5+really1.20.2-1, k8s.io/kubernetes 1.32.6 or 1.33.2, or Linux kernel commit 49fca83f6f3f0cafe5bf5b43e8ee81cf73c2d5e0. Rebuild and redeploy any custom kernels or container images that embed the vulnerable driver.

How to confirm the fix worked

Confirm the running kernel or Kubernetes component reports one of the listed fixed versions or contains commit 49fca83f6f3f0cafe5bf5b43e8ee81cf73c2d5e0; inspect /proc/version or component manifests and verify the source no longer uses hash_for_each_possible on the eve_data hash table.

Typical attack path

1. Obtain local or container access to a host running an affected kernel build
2. Trigger the xilinx soc driver code path that populates and iterates the hash table containing eve_data entries
3. Force the loop to free eve_data while hash_for_each_possible() still holds a reference
4. Exploit the resulting dangling pointer for memory corruption or control-flow hijacking

How to detect it

Review kernel logs for oops/panic messages referencing xilinx soc or eve_data around the time of suspected activity; correlate with process creation events that interact with the affected driver; no public exploitation artifacts are known.

What your security team should do

• Prioritize patching all affected Debian-packaged Kubernetes nodes and Go-based clusters within the next maintenance window
• Add kernel version checks to CI/CD pipelines to prevent reintroduction of vulnerable builds
• Monitor for any new exploit code targeting this UAF pattern given the 308-day publication window