CVE-2023-53043 (GCVE-0-2023-53043)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:55 – Updated: 2026-08-05 09:12
VLAI
Title
arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent If the controller is not marked as cache coherent, then kernel will try to ensure coherency during dma-ops and that may cause data corruption. So, mark the PCIe node as dma-coherent as the devices on PCIe bus are cache coherent.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 92e0ee9f83b3bc1d5644b1dc36eae730d1e8694d , < 267b899375bf38944d915c9654d6eb434edad0ce (git)
Affected: 92e0ee9f83b3bc1d5644b1dc36eae730d1e8694d , < e43bba938e2c9104bb4f8bc417ac4d7bb29755e1 (git)
Affected: 92e0ee9f83b3bc1d5644b1dc36eae730d1e8694d , < 8a63441e83724fee1ef3fd37b237d40d90780766 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.22 , ≤ 6.1.* (semver)
Unaffected: 6.2.9 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/boot/dts/qcom/sc7280.dtsi"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "267b899375bf38944d915c9654d6eb434edad0ce",
              "status": "affected",
              "version": "92e0ee9f83b3bc1d5644b1dc36eae730d1e8694d",
              "versionType": "git"
            },
            {
              "lessThan": "e43bba938e2c9104bb4f8bc417ac4d7bb29755e1",
              "status": "affected",
              "version": "92e0ee9f83b3bc1d5644b1dc36eae730d1e8694d",
              "versionType": "git"
            },
            {
              "lessThan": "8a63441e83724fee1ef3fd37b237d40d90780766",
              "status": "affected",
              "version": "92e0ee9f83b3bc1d5644b1dc36eae730d1e8694d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/boot/dts/qcom/sc7280.dtsi"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.22",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.9",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent\n\nIf the controller is not marked as cache coherent, then kernel will\ntry to ensure coherency during dma-ops and that may cause data corruption.\nSo, mark the PCIe node as dma-coherent as the devices on PCIe bus are\ncache coherent."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The missing dma-coherent property is on the SC7280 PCIe host; endpoints (notably built-in NVMe on Chromebooks/IDP) inherit that DT coherency via pci_dma_configure, and the bug is exercised by local block/filesystem I/O, not by network or adjacent-link protocols.\nAC:L - The controller is systematically treated as non-coherent on every DMA map/alloc on affected boards; a local process can reliably drive NVMe I/O and cache pressure to surface the incoherency, with no race or external precondition outside attacker influence.\nPR:L - Any unprivileged local user can generate PCIe/NVMe DMA traffic through ordinary file reads and writes on the root or data volume; no capability or real-root privilege is required.\nUI:N - Exploitation needs only the attacker\u2019s own I/O; no separate victim action such as mounting a crafted image or plugging a device is required.\nS:U - Impact is confined to kernel-managed DMA buffers for the PCIe/NVMe device under the existing IOMMU mapping; this is a cache-coherency attribute mismatch, not an IOMMU/DMA-boundary bypass or VM escape.\nC:H - Treating a coherent device as non-coherent causes post-DMA cache invalidates that can discard device-written lines so the CPU returns prior page contents (freed kernel/other-process memory) as file data, and the device may snoop stale cached data into completions and payloads.\nI:H - Stale cache contents can be what the NVMe device DMA-writes to storage or what corrupted submission-queue commands encode, corrupting file data and filesystem metadata, and the driver acts on malformed completion-queue entries it believes the controller wrote.\nA:H - The same class of bug corrupts NVMe submission/completion queues (invalid tags, probe/I/O failures), and incoherent DMA leads to I/O timeouts, controller resets, hangs, and kernel crashes on the primary storage path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:30.526Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/267b899375bf38944d915c9654d6eb434edad0ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/e43bba938e2c9104bb4f8bc417ac4d7bb29755e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a63441e83724fee1ef3fd37b237d40d90780766"
        }
      ],
      "title": "arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53043",
    "datePublished": "2025-05-02T15:55:00.724Z",
    "dateReserved": "2025-04-16T07:18:43.827Z",
    "dateUpdated": "2026-08-05T09:12:30.526Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53043",
      "date": "2026-08-30",
      "epss": "0.00196",
      "percentile": "0.09399"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53043\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-02T16:15:23.400\",\"lastModified\":\"2026-08-04T10:18:53.000\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent\\n\\nIf the controller is not marked as cache coherent, then kernel will\\ntry to ensure coherency during dma-ops and that may cause data corruption.\\nSo, mark the PCIe node as dma-coherent as the devices on PCIe bus are\\ncache coherent.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: dts: qcom: sc7280: Marcar el controlador PCIe como coherente con la cach\u00e9. Si el controlador no est\u00e1 marcado como coherente con la cach\u00e9, el kernel intentar\u00e1 asegurar la coherencia durante las operaciones DMA, lo que puede causar corrupci\u00f3n de datos. Por lo tanto, marque el nodo PCIe como coherente con la cach\u00e9, ya que los dispositivos en el bus PCIe s\u00ed lo son.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/boot/dts/qcom/sc7280.dtsi\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"92e0ee9f83b3bc1d5644b1dc36eae730d1e8694d\",\"lessThan\":\"267b899375bf38944d915c9654d6eb434edad0ce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"92e0ee9f83b3bc1d5644b1dc36eae730d1e8694d\",\"lessThan\":\"e43bba938e2c9104bb4f8bc417ac4d7bb29755e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"92e0ee9f83b3bc1d5644b1dc36eae730d1e8694d\",\"lessThan\":\"8a63441e83724fee1ef3fd37b237d40d90780766\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/boot/dts/qcom/sc7280.dtsi\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.22\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.9\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.22\",\"matchCriteriaId\":\"642B6F99-95C6-47F5-A9B1-5C45FE08CAD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.2.9\",\"matchCriteriaId\":\"914F22DD-1E6F-4B0A-A14D-3A9F068F6761\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8E3B0E8-FA27-4305-87BB-AF6C25B160CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A47F0FC3-CE52-4BA1-BA51-22F783938431\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3583026A-27EC-4A4C-850A-83F2AF970673\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/267b899375bf38944d915c9654d6eb434edad0ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a63441e83724fee1ef3fd37b237d40d90780766\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e43bba938e2c9104bb4f8bc417ac4d7bb29755e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:33:58+00:00",
      "cve": "CVE-2023-53043",
      "id": "CVE-2023-53043",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53043.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T02:25:55Z",
      "cve": "CVE-2023-53043",
      "id": "CVE-2023-53043",
      "initial_release_date": "2025-05-03T02:51:48Z",
      "product_status:known_not_affected": "397",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53043",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53043.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.