CVE-2023-53383: irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4
In the Linux kernel, the following vulnerability has been resolved:
irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4
The T241 platform suffers from the T241-FABRIC-4 erratum which causes
unexpected behavior in the GIC when multiple transactions are received
simultaneously from different sources. This hardware issue impacts
NVIDIA server platforms that use more than two T241 chips
interconnected. Each chip has support for 320 {E}SPIs.
This issue occurs when multiple packets from different GICs are
incorrectly interleaved at the target chip. The erratum text below
specifies exactly what can cause multiple transfer packets susceptible
to interleaving and GIC state corruption. GIC state corruption can
lead to a range of problems, including kernel panics, and unexpected
behavior.
>From the erratum text:
"In some cases, inter-socket AXI4 Stream packets with multiple
transfers, may be interleaved by the fabric when presented to ARM
Generic Interrupt Controller. GIC expects all transfers of a packet
to be delivered without any interleaving.
The following GICv3 commands may result in multiple transfer packets
over inter-socket AXI4 Stream interface:
- Register reads from GICD_I* and GICD_N*
- Register writes to 64-bit GICD registers other than GICD_IROUTERn*
- ITS command MOVALL
Multiple commands in GICv4+ utilize multiple transfer packets,
including VMOVP, VMOVI, VMAPP, and 64-bit register accesses."
This issue impacts system configurations with more than 2 sockets,
that require multi-transfer packets to be sent over inter-socket
AXI4 Stream interface between GIC instances on different sockets.
GICv4 cannot be supported. GICv3 SW model can only be supported
with the workaround. Single and Dual socket configurations are not
impacted by this issue and support GICv3 and GICv4."
Writing to the chip alias region of the GICD_In{E} registers except
GICD_ICENABLERn has an equivalent effect as writing to the global
distributor. The SPI interrupt deactivate path is not impacted by
the erratum.
To fix this problem, implement a workaround that ensures read accesses
to the GICD_In{E} registers are directed to the chip that owns the
SPI, and disable GICv4.x features. To simplify code changes, the
gic_configure_irq() function uses the same alias region for both read
and write operations to GICD_ICFGR.
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel reliability issue tied to a specific NVIDIA T241 server hardware erratum. Systems with more than two interconnected T241 chips can corrupt interrupt-controller state, potentially causing kernel panics or unexpected behavior. Single- and dual-socket configurations are stated as not impacted.
Executive priority
Treat as a targeted infrastructure availability issue. Prioritize only if the organization operates affected multi-socket NVIDIA T241 Linux servers. It is not broadly applicable and has no cited active exploitation, but impacted systems could experience serious stability failures.
Technical view
The issue involves ARM GICv3/GICv4 behavior on NVIDIA T241 platforms where inter-socket AXI4 Stream packets may be interleaved, corrupting GIC state. The kernel workaround directs GICD_In{E} reads to the SPI-owning chip and disables GICv4.x features. CVSS is 5.5, local, low complexity, low privileges, availability impact high.
Likely exposure
Exposure appears limited to Linux systems running on NVIDIA T241 server platforms with more than two interconnected sockets/chips. General Linux servers, and single- or dual-socket T241 configurations, are not described as impacted in the provided sources.
Exploitation context
No active exploitation is indicated; the CVE is not listed as KEV in the provided bundle. The source describes a hardware-triggered kernel availability risk requiring local conditions and affected multi-socket T241 topology, not a remote network attack path.
Researcher notes
Evidence is centered on Linux stable kernel commits and the CVE record. The root cause is a hardware erratum mitigated in software. Sources do not provide exploit reports, broad product advisories, or full distro-specific fixed-version mapping.
Mitigation direction
Identify whether any Linux systems use NVIDIA T241 platforms with more than two sockets.
Prioritize kernel updates containing the cited stable fixes for affected T241 systems.
Check Linux distribution and NVIDIA platform guidance for supported kernel versions.
Avoid enabling unsupported GICv4 configurations on impacted multi-socket T241 systems.
Validation and detection
Inventory hardware topology for NVIDIA T241 systems with more than two interconnected chips.
Confirm running kernel version includes the referenced GICv3 workaround commits.
Review kernel logs for GIC-related errors, panics, or unexplained interrupt behavior.
Verify GICv4.x features are disabled where the workaround requires it.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-53383 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.