CVE-2023-54287 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
tty: serial: imx: disable Ageing Timer interrupt request irq
There maybe pending USR interrupt before requesting irq, however uart_add_one_port has not executed, so there will be kernel panic: [ 0.795668] Unable to handle kernel NULL pointer dereference at virtual addre
ss 0000000000000080 [ 0.802701] Mem abort info:
[ 0.805367] ESR = 0x0000000096000004
[ 0.808950] EC = 0x25: DABT (current EL), IL = 32 bits
[ 0.814033] SET = 0, FnV = 0
[ 0.816950] EA = 0, S1PTW = 0
[ 0.819950] FSC = 0x04: level 0 translation fault
[ 0.824617] Data abort info:
[ 0.827367] ISV = 0, ISS = 0x00000004
[ 0.831033] CM = 0, WnR = 0
[ 0.833866] [0000000000000080] user address but active_mm is swapper
[ 0.839951] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[ 0.845953] Modules linked in:
[ 0.848869] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.1+g56321e101aca #1
[ 0.855617] Hardware name: Freescale i.MX8MP EVK (DT)
[ 0.860452] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 0.867117] pc : __imx_uart_rxint.constprop.0+0x11c/0x2c0
[ 0.872283] lr : imx_uart_int+0xf8/0x1ec
The issue only happends in the inmate linux when Jailhouse hypervisor enabled. The test procedure is: while true; do jailhouse enable imx8mp.cell jailhouse cell linux xxxx sleep 10 jailhouse cell destroy 1 jailhouse disable sleep 5 done
And during the upper test, press keys to the 2nd linux console. When `jailhouse cell destroy 1`, the 2nd linux has no chance to put the uart to a quiese state, so USR1/2 may has pending interrupts. Then when `jailhosue cell linux xx` to start 2nd linux again, the issue trigger.
In order to disable irqs before requesting them, both UCR1 and UCR2 irqs should be disabled, so here fix that, disable the Ageing Timer interrupt in UCR2 as UCR1 does.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability CVE-2023-54287 affects the Linux kernel's serial tty driver implementation specifically within the imx platform, where improper interrupt handling during hypervisor operations leads to kernel panic conditions. This flaw manifests when the Jailhouse hypervisor is enabled in an embedded Linux environment, particularly on Freescale i.MX8MP platforms. The root cause lies in the sequence of interrupt management operations during the initialization and teardown of virtualized serial console environments. When the jailhouse hypervisor destroys a cell and subsequently re-enables the Linux environment, pending USR interrupts may exist before the uart_add_one_port function executes, creating a race condition that results in NULL pointer dereference errors.
The technical implementation flaw occurs in the imx serial driver's interrupt request handling mechanism where the Ageing Timer interrupt is not properly disabled before new interrupt requests are processed. During the normal operation flow, when a second Linux console is created through jailhouse cell linux command, the system attempts to request interrupts without properly clearing or disabling existing interrupt states. The kernel panic occurs at virtual address 0x80 which corresponds to a NULL pointer dereference in the __imx_uart_rxint function, specifically at offset 0x11c in the code. The error trace shows that the system attempts to access memory through a null pointer in the context of a data abort exception with ESR value 0x96000004, indicating a translation fault at level 0.
This vulnerability directly relates to CWE-476 which describes NULL pointer dereference conditions, and the operational impact extends beyond simple system crashes to potentially compromising the stability of embedded systems running virtualized environments. The attack vector is particularly relevant in industrial IoT and automotive applications where hypervisor-based isolation is employed for security segmentation. The issue is specifically triggered during repeated enable/disable cycles of jailhouse hypervisor operations combined with active serial console input, making it a significant concern for embedded systems that rely on both virtualization capabilities and serial communication. The fix implemented addresses the underlying problem by ensuring proper interrupt state management through disabling both UCR1 and UCR2 interrupt requests, specifically disabling the Ageing Timer interrupt in UCR2 to match the behavior of UCR1, thereby preventing the race condition that leads to the kernel panic.
The mitigation strategy focuses on proper interrupt state management during the serial port initialization sequence, ensuring that all pending interrupts are cleared before new interrupt requests are processed. This aligns with ATT&CK technique T1553.006 for credential dumping and T1490 for endpoint denial of service, though the specific impact is more focused on system stability rather than direct exploitation. The fix prevents the kernel from attempting to access invalid memory addresses during interrupt handling, which would otherwise result in system crashes and potential denial of service conditions for serial communication services. The vulnerability demonstrates the complexity of interrupt management in virtualized environments and highlights the importance of proper resource cleanup and state management during system transitions, particularly when dealing with embedded platforms that require precise timing and interrupt handling for real-time operations.