CVE-2023-54255

What it actually does

Incorrect DMA channel offset calculations in the SH DMA driver for SH3/SH4/SH4A SoCs cause invalid memory accesses and kernel panics when accessing DMAOR registers or channel bases across multiple DMAC modules.

Why it matters to the business

Systems using affected SuperH SoCs may experience unexpected kernel crashes during DMA operations, leading to service interruptions on embedded or legacy hardware platforms.

How an attack unfolds

An attacker with the ability to trigger DMA channel allocation or register access on vulnerable hardware can cause the driver to compute an invalid base address, resulting in a kernel panic that denies service; no remote code execution path is indicated.

How to fix it

Update the Linux kernel to a version containing commit bca700b48c72f4ffeee977a2ed0eb4a6b4b7b8ad or later; rebuild and deploy the fixed kernel on affected SH3/SH4/SH4A platforms.

How to confirm the fix worked

Verify the presence of the fix by inspecting the dma_base_addr, dmaor_read_reg, and dmaor_write_reg functions in the SH DMA driver source; test DMA operations on target hardware to confirm absence of panics.

Typical attack path

1. Identify a system running the vulnerable SH DMA driver on supported SoC variants
2. Trigger DMA channel setup or register read/write operations through user-space interfaces or kernel subsystems
3. Cause miscalculated channel offsets leading to invalid memory dereference
4. Induce kernel panic and system halt

How to detect it

Review kernel logs for DMA-related panics or invalid address accesses on SH platforms; no specific post-exploitation artifacts are known beyond generic kernel crash dumps.

What your security team should do

• Prioritize kernel updates on all systems using the SH DMA driver
• Monitor for kernel oops or panic logs related to DMA on SuperH hardware
• Limit exposure by restricting unprivileged DMA access where possible until patched