CVE-2023-53070 is a vulnerability in the Linux kernel related to the Advanced Configuration and Power Interface (ACPI) subsystem, specifically the handling of the Processor Properties Topology Table (PPTT). The PPTT is used to provide information about processor cache topology, such as last-level cache (LLC) details, which the kernel fetches during CPU initialization and hotplug operations. The vulnerability arises from improper handling of the case when the PPTT is absent on a system. A recent kernel commit (0c80f9e165f8) optimized PPTT handling by mapping the table once and leaving it mapped for runtime usage to avoid repeated mapping/unmapping and potential sleeping in atomic contexts. However, this commit failed to account for systems without a PPTT, causing the function acpi_get_pptt() to be called by secondary CPUs in atomic context, attempting to fetch LLC information. Since acpi_get_table() may sleep waiting for a mutex, this leads to a BUG triggered by a sleeping function call in an invalid atomic context. The kernel stack trace shows that this results in a kernel panic or crash (splat), disrupting system operation. The fix involves updating acpi_get_pptt() to recognize when PPTT is absent and return NULL immediately, preventing any attempts to fetch the PPTT and avoiding sleeping in atomic context. This vulnerability affects Linux kernel versions containing the specified commits and can cause system instability or crashes on affected systems without PPTT tables during CPU initialization or hotplug events.

For European organizations relying on Linux-based systems, particularly servers and infrastructure running kernels affected by this vulnerability, the impact includes potential system crashes or kernel panics during CPU initialization or hotplug operations. This can lead to denial of service (DoS) conditions, affecting availability of critical services. Systems without PPTT tables are specifically vulnerable, which may include certain hardware configurations common in data centers or enterprise environments. The disruption caused by kernel panics can result in downtime, loss of productivity, and potential cascading failures in clustered or virtualized environments. While this vulnerability does not directly expose confidentiality or integrity risks, the availability impact can be significant for organizations with high uptime requirements. Additionally, recovery from kernel panics may require manual intervention, increasing operational overhead. Since exploitation does not require user interaction but occurs during kernel operations, attackers with local access or malicious code execution capabilities could trigger the crash intentionally to disrupt services.

European organizations should ensure that all Linux systems are updated to kernel versions that include the fix for CVE-2023-53070. Specifically, they should apply patches that update acpi_get_pptt() to handle the absence of PPTT correctly. System administrators should audit their hardware configurations to identify systems lacking PPTT tables and prioritize patching those systems. For environments using custom or long-term support kernels, backporting the fix is recommended. Additionally, monitoring kernel logs for BUG messages related to ACPI or PPTT can help detect attempts to trigger this issue. In virtualized or cloud environments, ensure hypervisor and guest kernel compatibility to avoid triggering the vulnerability during CPU hotplug events. Implementing automated kernel update mechanisms and testing patches in staging environments before production deployment will reduce downtime risks. Finally, consider restricting local access and hardening systems to prevent unauthorized code execution that could exploit this vulnerability to cause denial of service.