CVE-2023-54169

What it actually does

Memory leak in mlx5e_ptp_open when kvzalloc_node or kvzalloc fails, leaving pointers to "c" or "cparams" unfreed.

Why it matters to the business

Gradual memory exhaustion on systems with affected network hardware can lead to degraded performance or instability over extended uptime; low immediate risk given no known exploitation and low EPSS.

How an attack unfolds

An attacker would need to induce allocation failures in the PTP initialization path of the mlx5 driver, which is difficult to trigger remotely and has no known public exploits or threat actor usage.

How to fix it

Upgrade coredns/coredns to commit e1768a5d272e9da649dfb8588595e5c6e4e640bf or later; apply equivalent kernel patches for the mlx5e_ptp_open error handling path.

How to confirm the fix worked

Confirm the fixed commit is present in the running kernel or coredns build; monitor memory usage during PTP open error injection tests.

Typical attack path

1. Identify systems using mlx5 Ethernet adapters with PTP enabled
2. Trigger conditions causing kvzalloc failure during mlx5e_ptp_open
3. Accumulate leaked memory over repeated invocations
4. Observe system memory pressure or OOM events

How to detect it

Search kernel logs and memory profiling tools for repeated allocation failures in mlx5e_ptp_open without corresponding frees; no public IOCs available due to lack of observed exploitation.

What your security team should do

• Prioritize patching systems with mlx5 hardware and PTP usage within standard change windows
• Review kernel and coredns update policies to include memory leak fixes promptly
• Monitor EPSS and KEV updates for any increase in exploit maturity