CVE-2023-53398 (GCVE-0-2023-53398)
Vulnerability from cvelistv5
Published
2025-09-18 13:33
Modified
2026-08-05 09:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mlx5: fix possible ptp queue fifo use-after-free
Fifo indexes are not checked during pop operations and it leads to
potential use-after-free when poping from empty queue. Such case was
possible during re-sync action. WARN_ON_ONCE covers future cases.
There were out-of-order cqe spotted which lead to drain of the queue and
use-after-free because of lack of fifo pointers check. Special check and
counter are added to avoid resync operation if SKB could not exist in the
fifo because of OOO cqe (skb_id must be between consumer and producer
index).
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-53398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T19:00:48.835326Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T19:03:06.499Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c",
"drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h",
"drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
"drivers/net/ethernet/mellanox/mlx5/core/en_stats.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "52e6e7a0bc04c85012a9251c7cf2d444a77eb966",
"status": "affected",
"version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
"versionType": "git"
},
{
"lessThan": "6afdedc4e66e3846ce497744f01b95c34bf39d21",
"status": "affected",
"version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
"versionType": "git"
},
{
"lessThan": "3a50cf1e8e5157b82268eee7e330dbe5736a0948",
"status": "affected",
"version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c",
"drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h",
"drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
"drivers/net/ethernet/mellanox/mlx5/core/en_stats.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.18",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlx5: fix possible ptp queue fifo use-after-free\n\nFifo indexes are not checked during pop operations and it leads to\npotential use-after-free when poping from empty queue. Such case was\npossible during re-sync action. WARN_ON_ONCE covers future cases.\n\nThere were out-of-order cqe spotted which lead to drain of the queue and\nuse-after-free because of lack of fifo pointers check. Special check and\ncounter are added to avoid resync operation if SKB could not exist in the\nfifo because of OOO cqe (skb_id must be between consumer and producer\nindex)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is in the mlx5 PTP TX port-timestamp completion path (NAPI \u2192 mlx5e_ptp_handle_ts_cqe \u2192 fifo pop), reached only by locally originated skbs with SKBTX_HW_TSTAMP classified as PTP (UDP/319 or ethertype 0x88F7). A remote peer cannot set those TX flags or inject the DMA\u0027d CQEs the handler consumes.\nAC:L - An unprivileged local attacker fully controls the traffic that fills the PTP skb fifo and can burst PTP TX to provoke lost/out-of-order wire CQEs and the subsequent empty-fifo resync drain; the enabling tx_port_ts setting is routine in PTP deployments, not a rare config beyond attacker influence.\nPR:L - setsockopt(SO_TIMESTAMPING) with SOF_TIMESTAMPING_TX_HARDWARE and sending UDP to port 319 need no capabilities, and mlx5e_use_ptpsq() gates only on skb tx_flags and packet type\u2014so any unprivileged local user can drive the vulnerable path once the interface is in normal PTP TX-port-TS configuration.\nUI:N - The attacker\u2019s own packet transmissions and the resulting TS-CQE/NAPI processing trigger the empty-fifo pop and UAF with no action required from another user or administrator.\nS:U - Impact is confined to kernel heap objects (sk_buffs and the driver\u2019s skb fifo) in the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Popping an empty/stale fifo slot yields a use-after-free of sk_buff: mlx5e_skb_cb_get_hwts()/skb_tstamp_tx() read and clone freed slab memory onto a socket error queue, enabling heap disclosure via spraying.\nI:H - The same UAF leads to napi_consume_skb() on a freed (or reallocated) sk_buff, causing double-free/refcount underflow and writes into freed skb-\u003ecb via mlx5e_skb_cb_hwtstamp_handler\u2014heap corruption primitives suitable for control-flow hijack.\nA:H - Empty-fifo pops dereference NULL/stale pointers and double-free sk_buffs in softirq/NAPI context, producing kernel oopses/BUGs (and WARN_ON_ONCE under panic_on_warn) that take down the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:13:53.982Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/52e6e7a0bc04c85012a9251c7cf2d444a77eb966"
},
{
"url": "https://git.kernel.org/stable/c/6afdedc4e66e3846ce497744f01b95c34bf39d21"
},
{
"url": "https://git.kernel.org/stable/c/3a50cf1e8e5157b82268eee7e330dbe5736a0948"
}
],
"title": "mlx5: fix possible ptp queue fifo use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53398",
"datePublished": "2025-09-18T13:33:38.842Z",
"dateReserved": "2025-09-17T14:54:09.738Z",
"dateUpdated": "2026-08-05T09:13:53.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-53398\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T19:00:48.835326Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T19:00:44.675Z\"}}], \"cna\": {\"title\": \"mlx5: fix possible ptp queue fifo use-after-free\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The UAF is in the mlx5 PTP TX port-timestamp completion path (NAPI \\u2192 mlx5e_ptp_handle_ts_cqe \\u2192 fifo pop), reached only by locally originated skbs with SKBTX_HW_TSTAMP classified as PTP (UDP/319 or ethertype 0x88F7). A remote peer cannot set those TX flags or inject the DMA\u0027d CQEs the handler consumes.\\nAC:L - An unprivileged local attacker fully controls the traffic that fills the PTP skb fifo and can burst PTP TX to provoke lost/out-of-order wire CQEs and the subsequent empty-fifo resync drain; the enabling tx_port_ts setting is routine in PTP deployments, not a rare config beyond attacker influence.\\nPR:L - setsockopt(SO_TIMESTAMPING) with SOF_TIMESTAMPING_TX_HARDWARE and sending UDP to port 319 need no capabilities, and mlx5e_use_ptpsq() gates only on skb tx_flags and packet type\\u2014so any unprivileged local user can drive the vulnerable path once the interface is in normal PTP TX-port-TS configuration.\\nUI:N - The attacker\\u2019s own packet transmissions and the resulting TS-CQE/NAPI processing trigger the empty-fifo pop and UAF with no action required from another user or administrator.\\nS:U - Impact is confined to kernel heap objects (sk_buffs and the driver\\u2019s skb fifo) in the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed.\\nC:H - Popping an empty/stale fifo slot yields a use-after-free of sk_buff: mlx5e_skb_cb_get_hwts()/skb_tstamp_tx() read and clone freed slab memory onto a socket error queue, enabling heap disclosure via spraying.\\nI:H - The same UAF leads to napi_consume_skb() on a freed (or reallocated) sk_buff, causing double-free/refcount underflow and writes into freed skb-\u003ecb via mlx5e_skb_cb_hwtstamp_handler\\u2014heap corruption primitives suitable for control-flow hijack.\\nA:H - Empty-fifo pops dereference NULL/stale pointers and double-free sk_buffs in softirq/NAPI context, producing kernel oopses/BUGs (and WARN_ON_ONCE under panic_on_warn) that take down the host.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"58a518948f60153e8f6cb8361d2712aa3a1af94a\", \"lessThan\": \"52e6e7a0bc04c85012a9251c7cf2d444a77eb966\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"58a518948f60153e8f6cb8361d2712aa3a1af94a\", \"lessThan\": \"6afdedc4e66e3846ce497744f01b95c34bf39d21\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"58a518948f60153e8f6cb8361d2712aa3a1af94a\", \"lessThan\": \"3a50cf1e8e5157b82268eee7e330dbe5736a0948\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c\", \"drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h\", \"drivers/net/ethernet/mellanox/mlx5/core/en_stats.c\", \"drivers/net/ethernet/mellanox/mlx5/core/en_stats.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.2.*\"}, {\"status\": \"unaffected\", \"version\": \"6.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c\", \"drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h\", \"drivers/net/ethernet/mellanox/mlx5/core/en_stats.c\", \"drivers/net/ethernet/mellanox/mlx5/core/en_stats.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/52e6e7a0bc04c85012a9251c7cf2d444a77eb966\"}, {\"url\": \"https://git.kernel.org/stable/c/6afdedc4e66e3846ce497744f01b95c34bf39d21\"}, {\"url\": \"https://git.kernel.org/stable/c/3a50cf1e8e5157b82268eee7e330dbe5736a0948\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmlx5: fix possible ptp queue fifo use-after-free\\n\\nFifo indexes are not checked during pop operations and it leads to\\npotential use-after-free when poping from empty queue. Such case was\\npossible during re-sync action. WARN_ON_ONCE covers future cases.\\n\\nThere were out-of-order cqe spotted which lead to drain of the queue and\\nuse-after-free because of lack of fifo pointers check. Special check and\\ncounter are added to avoid resync operation if SKB could not exist in the\\nfifo because of OOO cqe (skb_id must be between consumer and producer\\nindex).\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.18\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2.5\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.3\", \"versionStartIncluding\": \"6.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:13:53.982Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-53398\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:13:53.982Z\", \"dateReserved\": \"2025-09-17T14:54:09.738Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-18T13:33:38.842Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…