GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53491 (GCVE-0-2023-53491)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:45 – Updated: 2026-08-05 09:14
VLAI
Title
start_kernel: Add __no_stack_protector function attribute
Summary
In the Linux kernel, the following vulnerability has been resolved: start_kernel: Add __no_stack_protector function attribute Back during the discussion of commit a9a3ed1eff36 ("x86: Fix early boot crash on gcc-10, third try") we discussed the need for a function attribute to control the omission of stack protectors on a per-function basis; at the time Clang had support for no_stack_protector but GCC did not. This was fixed in gcc-11. Now that the function attribute is available, let's start using it. Callers of boot_init_stack_canary need to use this function attribute unless they're compiled with -fno-stack-protector, otherwise the canary stored in the stack slot of the caller will differ upon the call to boot_init_stack_canary. This will lead to a call to __stack_chk_fail() then panic.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 420594296838fdc9a674470d710cda7d1487f9f4 , < 25e73018b4093e0cfbcec5dc4a4bb86d0b69ed56 (git)
Affected: 420594296838fdc9a674470d710cda7d1487f9f4 , < 514ca14ed5444b911de59ed3381dfd195d99fe4b (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 6.4.4 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kernel/smp.c",
            "include/linux/compiler_attributes.h",
            "init/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25e73018b4093e0cfbcec5dc4a4bb86d0b69ed56",
              "status": "affected",
              "version": "420594296838fdc9a674470d710cda7d1487f9f4",
              "versionType": "git"
            },
            {
              "lessThan": "514ca14ed5444b911de59ed3381dfd195d99fe4b",
              "status": "affected",
              "version": "420594296838fdc9a674470d710cda7d1487f9f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kernel/smp.c",
            "include/linux/compiler_attributes.h",
            "init/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.4",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstart_kernel: Add __no_stack_protector function attribute\n\nBack during the discussion of\ncommit a9a3ed1eff36 (\"x86: Fix early boot crash on gcc-10, third try\")\nwe discussed the need for a function attribute to control the omission\nof stack protectors on a per-function basis; at the time Clang had\nsupport for no_stack_protector but GCC did not. This was fixed in\ngcc-11. Now that the function attribute is available, let\u0027s start using\nit.\n\nCallers of boot_init_stack_canary need to use this function attribute\nunless they\u0027re compiled with -fno-stack-protector, otherwise the canary\nstored in the stack slot of the caller will differ upon the call to\nboot_init_stack_canary. This will lead to a call to __stack_chk_fail()\nthen panic."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - There is no network-reachable path to this code \u2014 `start_kernel()` and powerpc `start_secondary()` are kernel-initialization and CPU-bring-up entry points invoked from architecture assembly (`head_64.S`, `head_44x.S`, `head_85xx.S`) and from `__cpu_up()` during hotplug/resume, all of which are local to the machine. The vulnerable component is therefore only reachable via local system context (boot, CPU hotplug, suspend/resume).\nAC:L - On a kernel built with `CONFIG_STACKPROTECTOR=y` and a toolchain that instruments these functions, the stale-canary comparison mismatches deterministically on every boot and every secondary-CPU bring-up \u2014 there is no race, no memory-layout dependency, and no timing window to win. The failure reproduces reliably and at will, so no condition beyond the attacker\u0027s control gates it.\nPR:N - The panic in `start_kernel()` occurs during kernel initialization, before `init(1)` and before any user account, credential check, or namespace exists; the `start_secondary()` path is likewise entered from the secondary-CPU assembly stub with no privilege gate. No authentication or privilege of any kind is involved in reaching the faulty canary check.\nUI:N - No victim action is needed \u2014 the condition is hit automatically as part of normal boot and CPU bring-up. Nothing must be mounted, opened, or clicked.\nS:U - The `__stack_chk_fail()` \u2192 `panic()` sequence is entirely contained within the kernel\u0027s own security authority, affecting only the kernel that executed it. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - `__stack_chk_fail()` is a fail-stop check: it halts the system rather than reading or exposing memory, and no out-of-bounds read, uninitialized data, or attacker-retrievable kernel state is produced. Per the pure-crash guidance, there is no information disclosure.\nI:N - Nothing is written out of bounds and no object is corrupted \u2014 the canary in the caller\u0027s frame is intact; the comparison is a false positive caused by the canary *source* changing underneath it. There is no write primitive and no control-flow hijack potential.\nA:H - The outcome is `panic(\"stack-protector: Kernel stack is corrupted in: start_kernel\")`, i.e. an unbootable system, or a panic during secondary-CPU bring-up via `start_secondary()` on hotplug/resume. This is total, unrecoverable loss of availability for the affected machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:23.246Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/25e73018b4093e0cfbcec5dc4a4bb86d0b69ed56"
        },
        {
          "url": "https://git.kernel.org/stable/c/514ca14ed5444b911de59ed3381dfd195d99fe4b"
        }
      ],
      "title": "start_kernel: Add __no_stack_protector function attribute",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53491",
    "datePublished": "2025-10-01T11:45:43.101Z",
    "dateReserved": "2025-10-01T11:39:39.403Z",
    "dateUpdated": "2026-08-05T09:14:23.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53491",
      "date": "2026-09-16",
      "epss": "0.00297",
      "percentile": "0.22398"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53491\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-01T12:15:52.260\",\"lastModified\":\"2026-08-04T10:19:08.880\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nstart_kernel: Add __no_stack_protector function attribute\\n\\nBack during the discussion of\\ncommit a9a3ed1eff36 (\\\"x86: Fix early boot crash on gcc-10, third try\\\")\\nwe discussed the need for a function attribute to control the omission\\nof stack protectors on a per-function basis; at the time Clang had\\nsupport for no_stack_protector but GCC did not. This was fixed in\\ngcc-11. Now that the function attribute is available, let\u0027s start using\\nit.\\n\\nCallers of boot_init_stack_canary need to use this function attribute\\nunless they\u0027re compiled with -fno-stack-protector, otherwise the canary\\nstored in the stack slot of the caller will differ upon the call to\\nboot_init_stack_canary. This will lead to a call to __stack_chk_fail()\\nthen panic.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/powerpc/kernel/smp.c\",\"include/linux/compiler_attributes.h\",\"init/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"420594296838fdc9a674470d710cda7d1487f9f4\",\"lessThan\":\"25e73018b4093e0cfbcec5dc4a4bb86d0b69ed56\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"420594296838fdc9a674470d710cda7d1487f9f4\",\"lessThan\":\"514ca14ed5444b911de59ed3381dfd195d99fe4b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/powerpc/kernel/smp.c\",\"include/linux/compiler_attributes.h\",\"init/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.30\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.30\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.4\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.30\",\"versionEndExcluding\":\"6.4.4\",\"matchCriteriaId\":\"4437EDA8-E6B0-440F-B208-3A50A51A94C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/25e73018b4093e0cfbcec5dc4a4bb86d0b69ed56\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/514ca14ed5444b911de59ed3381dfd195d99fe4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:18:39+00:00",
      "cve": "CVE-2023-53491",
      "id": "CVE-2023-53491",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: start_kernel: Add __no_stack_protector function attribute",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53491.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T23:56:43Z",
      "cve": "CVE-2023-53491",
      "id": "CVE-2023-53491",
      "initial_release_date": "2025-10-01T23:30:16Z",
      "product_status:known_affected": "750",
      "product_status:known_not_affected": "54",
      "product_status:recommended": "310",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53491",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53491.json",
      "version": "54"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.