LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54204: mmc: sunplus: fix return value check of mmc_add_host()

In the Linux kernel, the following vulnerability has been resolved: mmc: sunplus: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, 1. the memory allocated in mmc_alloc_host() will be leaked 2. null-ptr-deref will happen when calling mmc_remove_host() in remove function spmmc_drv_remove() because deleting not added device. Fix this by checking the return value of mmc_add_host(). Moreover, I fixed the error handling path of spmmc_drv_probe() to clean up.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel driver defect in the Sunplus MMC code path. If adding the MMC host fails and the driver ignores that failure, cleanup can leak memory and later dereference a null pointer. The provided sources do not establish remote reachability, active exploitation, or business impact beyond affected Linux systems.

Executive priority

Treat this as targeted hygiene unless Sunplus MMC hardware is in production. There is no cited active exploitation or CVSS score, but kernel null pointer dereference bugs can affect availability and should be addressed through normal kernel maintenance.

Technical view

The vulnerable logic ignores errors from mmc_add_host() in the sunplus MMC driver. The stated effects are leaked memory from mmc_alloc_host() and null pointer dereference during spmmc_drv_remove() when removing a device that was never successfully added. Kernel stable commits fix the return-value check and cleanup path.

Likely exposure

Exposure appears limited to Linux kernels in the affected ranges and systems using the sunplus MMC driver path. The bundle lists Linux versions 6.2 through 6.4.12 and 6.5 as affected, but does not provide distribution package mappings or CPEs.

Exploitation context

The bundle marks KEV as false and cites no active exploitation. The described condition depends on an mmc_add_host() failure and later driver cleanup behavior. No public source in the bundle describes exploitability, remote attack surface, or privilege requirements.

Researcher notes

Evidence is limited to the CVE text and two kernel stable commit references. The issue is an error-handling bug, not a documented exploit chain. Further triage should map distro kernels to the upstream fix commits and confirm whether the driver is reachable on deployed hardware.

Mitigation direction

  • Check Linux vendor advisories for CVE-2023-54204 package status.
  • Update to a kernel build that includes the referenced stable fixes.
  • Prioritize systems using Sunplus MMC hardware or the sunplus MMC driver.
  • Track distribution backports rather than relying only on upstream version numbers.

Validation and detection

  • Inventory running kernel versions across Linux assets.
  • Check whether the sunplus MMC driver is present or loaded.
  • Confirm vendor kernel changelogs include the referenced stable commits.
  • Review crash logs for null pointer dereferences in spmmc_drv_remove().
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54204 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4e268fed8b1861616af28f9cfb4eed8ca5d7af6c, 4e268fed8b1861616af28f9cfb4eed8ca5d7af6cunaffected
LinuxLinux6.2, 0, 6.4.12, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.