CyberSecBulletin
CVE-2023-53521NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2023-53521 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 76f7050537476ac062ec23a544fbca8270f2d08b, 87e47be38d205df338c52ead43f23b2864567423, 40af9a6deed723485e05b7d3255a28750692e8db as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.15% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 76f7050537476ac062ec23a544fbca8270f2d08b or 87e47be38d205df338c52ead43f23b2864567423 or 40af9a6deed723485e05b7d3255a28750692e8db or 8f9542cad6c27297c8391de3a659f0b7948495d0, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.14.308 or 4.19.276 or 5.4.235 or 5.10.173, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux9927c68864e9c39cc317b4f559309ba29e642168 up to, but not including, 76f7050537476ac062ec23a544fbca8270f2d08b; 9927c68864e9c39cc317b4f559309ba29e642168 up to, but not including, 87e47be38d205df338c52ead43f23b2864567423; 9927c68864e9c39cc317b4f559309ba29e642168 up to, but not including, 40af9a6deed723485e05b7d3255a28750692e8db; 9927c68864e9c39cc317b4f559309ba29e642168 up to, but not including, 8f9542cad6c27297c8391de3a659f0b7948495d0; 9927c68864e9c39cc317b4f559309ba29e642168 up to, but not including, 0595cdb587726b4f0fa780eb7462e3679d141e82; 9927c68864e9c39cc317b4f559309ba29e642168 up to, but not including, 82143faf01dda831b89eccef60c39ef8575ab08a; 9927c68864e9c39cc317b4f559309ba29e642168 up to, but not including, 2fb1fa8425cce2dc4dce298275d22d7077694b73; 9927c68864e9c39cc317b4f559309ba29e642168 up to, but not including, 578797f0c8cbc2e3ec5fc0dab87087b4c7073686; and 1 more ranges76f7050537476ac062ec23a544fbca8270f2d08b, 87e47be38d205df338c52ead43f23b2864567423, 40af9a6deed723485e05b7d3255a28750692e8db, 8f9542cad6c27297c8391de3a659f0b7948495d0, 0595cdb587726b4f0fa780eb7462e3679d141e82, 82143faf01dda831b89eccef60c39ef8575ab08a
LinuxLinux Kernel2.6.25 up to, but not including, 4.14.308; 4.15 up to, but not including, 4.19.276; 4.20 up to, but not including, 5.4.235; 5.5 up to, but not including, 5.10.173; 5.11 up to, but not including, 5.15.99; 5.16 up to, but not including, 6.1.16; 6.2 up to, but not including, 6.2.34.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() A fix for: BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses] Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/12013 When edev->components is zero, accessing edev->component[0] members is wrong.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.