CVE-2023-54194

What it actually does

The vulnerability causes memory allocation failures when mounting exFAT filesystems on systems with fragmented physical memory because the code requires contiguous memory blocks via kmalloc_array instead of allowing non-contiguous allocations with kvmalloc_array.

Why it matters to the business

Systems may fail to recognize or mount removable storage devices using the exFAT filesystem, leading to operational disruptions especially on long-running servers or embedded devices.

How an attack unfolds

An attacker can trigger the issue by inserting or attempting to mount an exFAT-formatted USB drive on a vulnerable kernel, causing a page allocation failure and preventing the filesystem from being mounted.

How to fix it

Update the Linux kernel to a version containing commit 79d16a84ea41272dfcb0c00f9798ddd0edd8098d or equivalent that replaces kmalloc_array with kvmalloc_array in the exfat driver.

How to confirm the fix worked

Verify the kernel source includes the kvmalloc_array usage in load_alloc_bitmap or exfat_fill_super functions; test mounting exFAT devices on memory-fragmented systems.

Typical attack path

1. Insert exFAT-formatted removable media
2. Trigger mount operation on the device
3. Kernel attempts contiguous memory allocation which fails due to fragmentation
4. Mount fails with allocation error

How to detect it

Look for kernel logs showing page allocation failures with order:4 in exfat_fill_super or load_alloc_bitmap functions during mount attempts.

• page allocation failure: order:4
• exfat_fill_super
• load_alloc_bitmap
• mode:0x6040c0(GFP_KERNEL|__GFP_COMP)

What your security team should do

• Apply the kernel patch or upgrade to a fixed version promptly
• Monitor for allocation failure logs related to exfat
• Consider using alternative filesystems for removable media if patching is delayed