LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54057: iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow, because the string specifier in the format string sscanf() has no width limitation. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-54057 is a Linux kernel AMD IOMMU parsing flaw. A specially long ivrs_acpihid boot parameter may overflow a fixed buffer during startup. The main business concern is kernel stability or memory corruption on systems where an attacker can influence boot parameters. Public sources do not show active exploitation or a CVSS score.

Executive priority

Treat as a controlled remediation item, not an emergency, unless your environment allows untrusted boot-parameter changes. Prioritize kernel updates through normal maintenance and verify bootloader governance on sensitive Linux hosts.

Technical view

The issue is in parse_ivrs_acpihid in the AMD IOMMU code. The acpiid buffer may overflow because sscanf used a string specifier without a width limit. Linux stable commits add a length limitation for the ivrs_acpihid command-line parameter. The CVE source lists Linux kernel versions and stable commits, but does not provide exploitability details.

Likely exposure

Exposure appears limited to Linux systems using affected kernel versions where the AMD IOMMU ivrs_acpihid kernel command-line parameter can be set or modified. Systems without attacker influence over boot configuration are less exposed, based on the provided description.

Exploitation context

No cited source reports active exploitation, and KEV status is false. Practical exploitation likely depends on control of kernel boot parameters or trusted boot configuration paths. The source bundle does not establish remote exploitability, privilege boundaries, or reliable impact beyond the buffer overflow condition.

Researcher notes

The source evidence is narrow: a kernel commit description, affected version metadata, no CVSS, no CWE, and no exploitation report. Analysis should stay focused on boot-time command-line parsing and avoid claiming remote code execution or broad exploitability without additional vendor evidence.

Mitigation direction

  • Update to a Linux kernel containing the referenced stable fix commits.
  • Review vendor kernel advisories for your distribution-specific fixed packages.
  • Restrict unauthorized modification of bootloader and kernel command-line settings.
  • Use secure boot and change-control controls where supported.

Validation and detection

  • Inventory Linux kernel versions across affected server and endpoint fleets.
  • Check boot configurations for use of the ivrs_acpihid parameter.
  • Confirm deployed kernels include the relevant stable fix for their branch.
  • Review distribution advisories before treating upstream commit hashes as package status.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54057 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxca3bf5d47cec8b7614bcb2e9132c40081d6d81db, ca3bf5d47cec8b7614bcb2e9132c40081d6d81db, ca3bf5d47cec8b7614bcb2e9132c40081d6d81db, ca3bf5d47cec8b7614bcb2e9132c40081d6d81db, ca3bf5d47cec8b7614bcb2e9132c40081d6d81db, ca3bf5d47cec8b7614bcb2e9132c40081d6d81dbunaffected
LinuxLinux4.7, 0, 5.4.237, 5.10.175, 5.15.103, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.