CVE-2023-53675 (GCVE-0-2023-53675)
Vulnerability from cvelistv5
Published
2025-10-07 15:21
Modified
2026-08-05 09:15
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible desc_ptr out-of-bounds accesses Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process().
References
Impacted products
Vendor Product Version
Linux Linux Version: 9927c68864e9c39cc317b4f559309ba29e642168
Version: 9927c68864e9c39cc317b4f559309ba29e642168
Version: 9927c68864e9c39cc317b4f559309ba29e642168
Version: 9927c68864e9c39cc317b4f559309ba29e642168
Version: 9927c68864e9c39cc317b4f559309ba29e642168
Version: 9927c68864e9c39cc317b4f559309ba29e642168
Version: 9927c68864e9c39cc317b4f559309ba29e642168
Version: 9927c68864e9c39cc317b4f559309ba29e642168
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/ses.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "72021ae61a2bc6ca73cd593e255a10ed5f5dc5e7",
              "status": "affected",
              "version": "9927c68864e9c39cc317b4f559309ba29e642168",
              "versionType": "git"
            },
            {
              "lessThan": "cffe09ca0555e235a42d6fa065e463c4b3d5b657",
              "status": "affected",
              "version": "9927c68864e9c39cc317b4f559309ba29e642168",
              "versionType": "git"
            },
            {
              "lessThan": "79ec5dd5fb07ecaea2f978c2d7a9f2f3526e4d19",
              "status": "affected",
              "version": "9927c68864e9c39cc317b4f559309ba29e642168",
              "versionType": "git"
            },
            {
              "lessThan": "c315560e3ef77c1d822249f1743e647dc9c9912a",
              "status": "affected",
              "version": "9927c68864e9c39cc317b4f559309ba29e642168",
              "versionType": "git"
            },
            {
              "lessThan": "584892fd29a41ef424a148118a3103b16b94fb8c",
              "status": "affected",
              "version": "9927c68864e9c39cc317b4f559309ba29e642168",
              "versionType": "git"
            },
            {
              "lessThan": "414418abc19fa4ccf730d273061a426c07a061d6",
              "status": "affected",
              "version": "9927c68864e9c39cc317b4f559309ba29e642168",
              "versionType": "git"
            },
            {
              "lessThan": "4b8cae410472653a59e15af62c57c49b8e0a1201",
              "status": "affected",
              "version": "9927c68864e9c39cc317b4f559309ba29e642168",
              "versionType": "git"
            },
            {
              "lessThan": "801ab13d50cf3d26170ee073ea8bb4eececb76ab",
              "status": "affected",
              "version": "9927c68864e9c39cc317b4f559309ba29e642168",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/ses.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.308",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.173",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.308",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.276",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.235",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.173",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.99",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.16",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.3",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ses: Fix possible desc_ptr out-of-bounds accesses\n\nSanitize possible desc_ptr out-of-bounds accesses in\nses_enclosure_data_process()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The malformed page 7 payload is supplied by the enclosure target over the storage fabric (SAS expander/enclosure, FC, or iSCSI/SRP target), so a rogue or compromised device on the SAN segment reaches the parser with no local access. This matches the CNA\u0027s treatment of the sibling fixes in the same series (CVE-2023-53803, CVE-2023-7324); a malicious USB device asserting the EncServ INQUIRY bit is an additional, less severe path.\nAC:L - The attacker controls both the page 7 length header and every descriptor byte, so positioning desc_ptr just under buf + page7_len and reporting a descriptor length of 0xFFFF deterministically drives the read, the NUL write, and the name pointer out of bounds on every probe. No race, timing window, or uncontrolled memory layout is involved.\nPR:N - ses_intf_add() is a class_interface on sdev_class and runs automatically during SCSI LUN discovery/rescan for any target that sets the EncServ bit in its own INQUIRY response, so no account, credential, or capability on the host is required. The KASAN report in the companion fix was produced by systemd-udevd during ordinary enumeration.\nUI:N - Enclosure probing is driven by the kernel\u0027s automatic device discovery on link-up, hotplug, and session re-establishment, and TYPE_ENCLOSURE autoloads the ses module via its modalias. No mount, open, or configuration action by a victim is needed.\nS:U - The out-of-bounds read and NUL write both land in the kernel\u0027s own slab memory and the leaked bytes surface through the kernel\u0027s enclosure sysfs interface. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - With the terminating NUL written far past the allocation, name = desc_ptr points at out-of-bounds heap and enclosure_component_alloc() copies it via snprintf(newname, 64, \"%s\", name) into dev_set_name(), exposing up to 63 bytes of adjacent kernel heap as a world-readable /sys/class/enclosure/ directory name. Repeated re-probes resample different heap neighbours, giving a reliable heap-disclosure and KASLR-defeat oracle.\nI:H - desc_ptr[len] = \u0027\\0\u0027 with an unbounded 16-bit device-supplied len writes a zero byte at an attacker-chosen offset of up to ~64 KB beyond the kzalloc\u0027d buffer \u2014 a controlled out-of-bounds heap write and the classic poison-null-byte primitive for corrupting adjacent object headers, length fields, and pointers. It is repeatable on every discovery cycle, so it is exploitable for control-flow-relevant heap corruption, not merely stray damage.\nA:H - The far out-of-bounds write and the descriptor read can reach unmapped memory beyond the slab page, oopsing the udev-context probe thread, and trip a KASAN slab-out-of-bounds report that panics hosts running panic_on_warn. Even short of a panic, corrupting adjacent slab metadata leads to allocator failure and kernel crash, and the attacker can force it on every enumeration."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:15:28.660Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/72021ae61a2bc6ca73cd593e255a10ed5f5dc5e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cffe09ca0555e235a42d6fa065e463c4b3d5b657"
        },
        {
          "url": "https://git.kernel.org/stable/c/79ec5dd5fb07ecaea2f978c2d7a9f2f3526e4d19"
        },
        {
          "url": "https://git.kernel.org/stable/c/c315560e3ef77c1d822249f1743e647dc9c9912a"
        },
        {
          "url": "https://git.kernel.org/stable/c/584892fd29a41ef424a148118a3103b16b94fb8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/414418abc19fa4ccf730d273061a426c07a061d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b8cae410472653a59e15af62c57c49b8e0a1201"
        },
        {
          "url": "https://git.kernel.org/stable/c/801ab13d50cf3d26170ee073ea8bb4eececb76ab"
        }
      ],
      "title": "scsi: ses: Fix possible desc_ptr out-of-bounds accesses",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53675",
    "datePublished": "2025-10-07T15:21:31.018Z",
    "dateReserved": "2025-10-07T15:16:59.663Z",
    "dateUpdated": "2026-08-05T09:15:28.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.