CVE-2024-53153 is a vulnerability identified in the Linux kernel specifically related to the Qualcomm PCIe endpoint controller (qcom-ep). The issue arises from the timing of controller cleanup functions during the assertion of the PCIe reset signal (PERST#) by the host. In the vulnerable state, cleanup functions such as dw_pcie_ep_cleanup() and pci_epc_deinit_notify() are executed when the host asserts PERST#, a time when the reference clock (refclk) provided by the host is disabled shortly thereafter. Since Qualcomm endpoint SoCs depend on this refclk to keep the PCIe controller operational, accessing hardware registers without an active refclk causes the entire endpoint to crash. The root cause is that cleanup operations require register access, which is invalid without the refclk, leading to a system crash. The vulnerability cannot be fully mitigated by generating the refclk internally on the endpoint side due to design constraints in some Qualcomm SoCs. The implemented fix involves moving the cleanup routines to the start of the qcom_pcie_perst_deassert() function, which is invoked when the host deasserts PERST# and the refclk is guaranteed to be active. This change ensures that cleanup occurs only when hardware registers are accessible, preventing crashes. This vulnerability affects Linux kernel versions containing the affected Qualcomm PCIe endpoint driver code and impacts systems using Qualcomm endpoint SoCs relying on host-supplied refclk for PCIe operations.

For European organizations, the impact of CVE-2024-53153 primarily concerns systems running Linux kernels with Qualcomm PCIe endpoint SoCs that depend on host-supplied refclk. Affected devices could include embedded systems, networking equipment, IoT devices, and industrial control systems that utilize Qualcomm SoCs with this PCIe controller design. The vulnerability can cause endpoint crashes during PCIe reset sequences, potentially leading to system instability, device malfunctions, or denial of service conditions. In critical infrastructure or industrial environments, such crashes could disrupt operations or degrade system reliability. Although no known exploits are currently reported in the wild, the vulnerability could be leveraged by attackers with local access or through crafted PCIe interactions to induce crashes, impacting availability. The confidentiality and integrity impact is limited since the vulnerability causes crashes rather than unauthorized data access or code execution. However, availability degradation in critical systems could have cascading effects on business continuity and operational safety in sectors such as telecommunications, manufacturing, and transportation within Europe.

To mitigate CVE-2024-53153, European organizations should: 1) Ensure Linux kernel versions are updated to include the patch that moves controller cleanup to qcom_pcie_perst_deassert(), thereby avoiding register access without refclk. 2) Audit and identify devices using Qualcomm endpoint SoCs with host-supplied refclk PCIe controllers, prioritizing firmware and kernel updates on these systems. 3) For embedded and industrial devices where kernel updates may be delayed, consider implementing hardware or firmware workarounds that ensure refclk stability during PCIe reset sequences or isolate vulnerable endpoints to minimize impact. 4) Monitor system logs and PCIe reset events for signs of endpoint crashes or instability that could indicate unpatched systems. 5) Engage with device vendors and Qualcomm for guidance on secure firmware versions and best practices for endpoint PCIe controller management. 6) Incorporate this vulnerability into risk assessments for critical systems using affected hardware to plan for timely patch deployment and incident response readiness.