423 lines
22 KiB
JSON
423 lines
22 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2023-53331",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2025-09-16T16:08:59.564Z",
|
||
"datePublished": "2025-09-16T16:12:06.788Z",
|
||
"dateUpdated": "2026-08-05T09:13:32.268Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T09:13:32.268Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore/ram: Check start of empty przs during init\n\nAfter commit 30696378f68a (\"pstore/ram: Do not treat empty buffers as\nvalid\"), initialization would assume a prz was valid after seeing that\nthe buffer_size is zero (regardless of the buffer start position). This\nunchecked start value means it could be outside the bounds of the buffer,\nleading to future access panics when written to:\n\n sysdump_panic_event+0x3b4/0x5b8\n atomic_notifier_call_chain+0x54/0x90\n panic+0x1c8/0x42c\n die+0x29c/0x2a8\n die_kernel_fault+0x68/0x78\n __do_kernel_fault+0x1c4/0x1e0\n do_bad_area+0x40/0x100\n do_translation_fault+0x68/0x80\n do_mem_abort+0x68/0xf8\n el1_da+0x1c/0xc0\n __raw_writeb+0x38/0x174\n __memcpy_toio+0x40/0xac\n persistent_ram_update+0x44/0x12c\n persistent_ram_write+0x1a8/0x1b8\n ramoops_pstore_write+0x198/0x1e8\n pstore_console_write+0x94/0xe0\n ...\n\nTo avoid this, also check if the prz start is 0 during the initialization\nphase. If not, the next prz sanity check case will discover it (start >\nsize) and zap the buffer back to a sane state.\n\n[kees: update commit log with backtrace and clarifications]"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The vulnerable path is confined to local pstore/ramoops initialization and subsequent local writes (pstore console, `/dev/pmsg0` via `persistent_ram_write_user`, or other ramoops backends); there is no network or adjacent-radio entry point into `fs/pstore/ram_core.c`.\nAC:L - Once an empty-but-invalid prz header (valid sig, size 0, non-zero start) is present in persistent RAM—observed in the field and retained across soft reboot on common Android/embedded ramoops deployments—the next write deterministically performs an out-of-bounds update with no race or ASLR dependency; scored Low under the uncertainty/highest-severity rule.\nPR:L - In the highest-impact realistic deployment (Android/ChromeOS-style ramoops with pmsg enabled), an unprivileged local actor can trigger the write through `/dev/pmsg0` (kernel default 0220, often further relaxed on Android) or rely on automatic pstore console writes after boot, without needing real init-namespace root.\nUI:N - No victim action is required: after a vulnerable boot accept of the bad empty buffer, the kernel itself writes via the pstore console on printk/panic, or the attacker writes `/dev/pmsg0` directly.\nS:U - The out-of-bounds write corrupts addresses within the kernel’s own ramoops mapping/security domain and does not cross a VM, IOMMU, or other separate authority boundary.\nC:H - This is an out-of-bounds write through `persistent_ram_update`/`_user` into memory past the logical buffer; per kernel scoring guidance such memory corruption is treated as enabling high confidentiality impact (information disclosure primitives), matching CWE-787 assessment of this CVE.\nI:H - The bug issues a attacker-influenced (pmsg) or kernel-sourced (console) out-of-bounds store via `memcpy_toio`/`copy_from_user` at a corrupted start offset, which is integrity-high memory corruption that can overwrite adjacent mapped persistent-RAM contents and is scored as exploitable for control-flow impact under the OOB-write rule.\nA:H - The demonstrated consequence is a kernel translation fault/oops during the out-of-bounds write (see the fix backtrace through `persistent_ram_write` → `__memcpy_toio`), which is a full availability loss."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/pstore/ram_core.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "e1e3a46706bd4037e8b7407dc660ae6e05b8ac56",
|
||
"lessThan": "89312657337e6e03ad6e9ea1a462bd9c158c85c8",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "265242d82a3c6a8bd9120d06b4801f8d7ae9a346",
|
||
"lessThan": "c807ccdd812d18985860504b503899f3140a9549",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "30696378f68a9e3dad6bfe55938b112e72af00c2",
|
||
"lessThan": "e972231db29b5d1dccc13bf9d5ba55b6979a69ed",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "30696378f68a9e3dad6bfe55938b112e72af00c2",
|
||
"lessThan": "dc2f60de9a7d3efd982440117dab5579898d808c",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "30696378f68a9e3dad6bfe55938b112e72af00c2",
|
||
"lessThan": "fedecaeef88899d940b69368c996e8b3b0b8650d",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "30696378f68a9e3dad6bfe55938b112e72af00c2",
|
||
"lessThan": "e95d7a8a6edd14f8fab44c777dd7281db91f6ae2",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "30696378f68a9e3dad6bfe55938b112e72af00c2",
|
||
"lessThan": "f77990358628b01bdc03752126ff5f716ea37615",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "30696378f68a9e3dad6bfe55938b112e72af00c2",
|
||
"lessThan": "25fb4e3402d46f425ec135ef6f09792a4c1b3003",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "30696378f68a9e3dad6bfe55938b112e72af00c2",
|
||
"lessThan": "fe8c3623ab06603eb760444a032d426542212021",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "ec7f99261da9a20d63cbd273511a11a2efe698f2",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f250e4c562a3bd106575032666e9ef46f31231f8",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "fffdbf586866e9500b53c9d4b061d3983720375a",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9e969ba431b46b1891c88cea36f722f3bfe8a180",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "4.14.96",
|
||
"lessThan": "4.14.326",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.19.18",
|
||
"lessThan": "4.19.295",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "3.18.133",
|
||
"lessThan": "3.19",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.4.172",
|
||
"lessThan": "4.5",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.9.153",
|
||
"lessThan": "4.10",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.20.5",
|
||
"lessThan": "4.21",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/pstore/ram_core.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "5.0",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "5.0",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.14.326",
|
||
"lessThanOrEqual": "4.14.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.19.295",
|
||
"lessThanOrEqual": "4.19.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.257",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.195",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.132",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.53",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.4.16",
|
||
"lessThanOrEqual": "6.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.5.3",
|
||
"lessThanOrEqual": "6.5.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.14.96",
|
||
"versionEndExcluding": "4.14.326"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.19.18",
|
||
"versionEndExcluding": "4.19.295"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.0",
|
||
"versionEndExcluding": "5.4.257"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.0",
|
||
"versionEndExcluding": "5.10.195"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.0",
|
||
"versionEndExcluding": "5.15.132"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.0",
|
||
"versionEndExcluding": "6.1.53"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.0",
|
||
"versionEndExcluding": "6.4.16"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.0",
|
||
"versionEndExcluding": "6.5.3"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.0",
|
||
"versionEndExcluding": "6.6"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "3.18.133"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.4.172"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.9.153"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.20.5"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/89312657337e6e03ad6e9ea1a462bd9c158c85c8"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/c807ccdd812d18985860504b503899f3140a9549"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e972231db29b5d1dccc13bf9d5ba55b6979a69ed"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/dc2f60de9a7d3efd982440117dab5579898d808c"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/fedecaeef88899d940b69368c996e8b3b0b8650d"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e95d7a8a6edd14f8fab44c777dd7281db91f6ae2"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f77990358628b01bdc03752126ff5f716ea37615"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/25fb4e3402d46f425ec135ef6f09792a4c1b3003"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/fe8c3623ab06603eb760444a032d426542212021"
|
||
}
|
||
],
|
||
"title": "pstore/ram: Check start of empty przs during init",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"scope": "UNCHANGED",
|
||
"version": "3.1",
|
||
"baseScore": 7.8,
|
||
"attackVector": "LOCAL",
|
||
"baseSeverity": "HIGH",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"integrityImpact": "HIGH",
|
||
"userInteraction": "NONE",
|
||
"attackComplexity": "LOW",
|
||
"availabilityImpact": "HIGH",
|
||
"privilegesRequired": "LOW",
|
||
"confidentialityImpact": "HIGH"
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2023-53331",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2026-01-14T18:30:13.040006Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"type": "CWE",
|
||
"cweId": "CWE-787",
|
||
"description": "CWE-787 Out-of-bounds Write"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-01-14T18:32:59.884Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |