277 lines
15 KiB
JSON
277 lines
15 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2023-53729",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2025-10-22T13:21:37.349Z",
|
||
"datePublished": "2025-10-22T13:23:57.739Z",
|
||
"dateUpdated": "2026-10-15T21:41:34.911Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T09:15:43.640Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: qmi_encdec: Restrict string length in decode\n\nThe QMI TLV value for strings in a lot of qmi element info structures\naccount for null terminated strings with MAX_LEN + 1. If a string is\nactually MAX_LEN + 1 length, this will cause an out of bounds access\nwhen the NULL character is appended in decoding."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The decoder is fed by QMI messages arriving on a kernel AF_QIPCRTR socket; an unprivileged local process can create such a socket without any capability check and `sendto()` a local-node port, which `qrtr_local_enqueue()` delivers directly to the in-kernel QMI handle. The alternative source is the modem/WLAN firmware over an on-SoC IPC bus, which is not a network transport either.\nAC:L - Triggering is fully deterministic — craft a QMI TLV whose string length equals `elem_len` and send it to the handle's port; kernel handles autobind within the 16384-entry ephemeral range 0x4000–0x7fff, which is trivially swept or resolved through the QRTR name service. No race, no memory-layout precondition, and no sender check exists in `qmi_handle_message()`.\nPR:L - Only an ordinary local account is needed: `qrtr_create()` enforces no capability, and only binding to a reserved port (unnecessary here) requires CAP_NET_ADMIN. No root, no CAP_NET_ADMIN, and no group membership is required to send to the kernel handle.\nUI:N - The attacker sends the malformed QMI message directly to the always-listening kernel handle; decoding happens in the handle's workqueue with no victim action. No mount, file open, or administrator step is involved.\nS:U - The out-of-bounds write corrupts kernel heap or kernel stack memory within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The off-by-one NUL landing immediately past a slab object is a classic poison-NUL primitive — zeroing the low byte of an adjacent object's length, index, or pointer field converts into an over-read of neighbouring kernel memory. Consistent with treating exploitable memory corruption as enabling arbitrary read.\nI:H - This is an attacker-triggered out-of-bounds write: a zero byte placed one element past a fixed-size array, reaching past the end of the `kzalloc()`ed decode buffer when the string is the trailing struct member, or past a stack-allocated response struct in the ath10k/ath11k/ath12k transaction path. Heap and stack off-by-one NUL overflows are established stepping stones to control-flow hijack.\nA:H - Corrupting the byte past a slab object or a stack frame can damage allocator/adjacent-object state and panic the kernel, and hardened configurations (KASAN, SLUB redzoning) turn the write into an immediate BUG. The attacker can repeat the send indefinitely with no rate limit."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/soc/qcom/qmi_encdec.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
|
||
"lessThan": "6b58859e7c4ac357517a59f0801e8ce1b58a8ee2",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
|
||
"lessThan": "64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
|
||
"lessThan": "2ccab9f82772ead618689d17dbc6950d6bd1e741",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
|
||
"lessThan": "b2f39b813d1eed4a522428d1e6acd7dfe9b81579",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
|
||
"lessThan": "f6250ecb7fbb934b89539e7e2ba6c1d8555c0975",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
|
||
"lessThan": "22ee7c9c7f381be178b4457bc54530002e08e938",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
|
||
"lessThan": "8d207400fd6b79c92aeb2f33bb79f62dff904ea2",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/soc/qcom/qmi_encdec.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "4.16",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "4.16",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.19.295",
|
||
"lessThanOrEqual": "4.19.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.257",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.195",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.132",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.54",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.5.4",
|
||
"lessThanOrEqual": "6.5.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.16",
|
||
"versionEndExcluding": "4.19.295"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.16",
|
||
"versionEndExcluding": "5.4.257"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.16",
|
||
"versionEndExcluding": "5.10.195"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.16",
|
||
"versionEndExcluding": "5.15.132"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.16",
|
||
"versionEndExcluding": "6.1.54"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.16",
|
||
"versionEndExcluding": "6.5.4"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.16",
|
||
"versionEndExcluding": "6.6"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/6b58859e7c4ac357517a59f0801e8ce1b58a8ee2"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/2ccab9f82772ead618689d17dbc6950d6bd1e741"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/b2f39b813d1eed4a522428d1e6acd7dfe9b81579"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f6250ecb7fbb934b89539e7e2ba6c1d8555c0975"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/22ee7c9c7f381be178b4457bc54530002e08e938"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/8d207400fd6b79c92aeb2f33bb79f62dff904ea2"
|
||
}
|
||
],
|
||
"title": "soc: qcom: qmi_encdec: Restrict string length in decode",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2023-53729",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2026-10-15T21:36:52.702792Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-10-15T21:41:34.911Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |