CVE-2023-53510 (GCVE-0-2023-53510)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:45 – Updated: 2026-08-05 09:14
VLAI
Title
scsi: ufs: core: Fix handling of lrbp->cmd
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix handling of lrbp->cmd ufshcd_queuecommand() may be called two times in a row for a SCSI command before it is completed. Hence make the following changes: - In the functions that submit a command, do not check the old value of lrbp->cmd nor clear lrbp->cmd in error paths. - In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd. See also scsi_send_eh_cmnd(). This commit prevents that the following appears if a command times out: WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8 Call trace: ufshcd_queuecommand+0x6f8/0x9a8 scsi_send_eh_cmnd+0x2c0/0x960 scsi_eh_test_devices+0x100/0x314 scsi_eh_ready_devs+0xd90/0x114c scsi_error_handler+0x2b4/0xb70 kthread+0x16c/0x1e0
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 , < b6d76d63c6d21d5d26c301a46853a2aee72397d5 (git)
Affected: 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 , < f3ee24af62681b942bbd799ac77b90a6d7e1fdb1 (git)
Affected: 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 , < 49234a401e161a2f2698f4612ab792c49b3cad1b (git)
Affected: 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 , < 549e91a9bbaa0ee480f59357868421a61d369770 (git)
Create a notification for this product.
Linux Linux Affected: 3.12
Unaffected: 0 , < 3.12 (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.3.13 , ≤ 6.3.* (semver)
Unaffected: 6.4.4 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b6d76d63c6d21d5d26c301a46853a2aee72397d5",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            },
            {
              "lessThan": "f3ee24af62681b942bbd799ac77b90a6d7e1fdb1",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            },
            {
              "lessThan": "49234a401e161a2f2698f4612ab792c49b3cad1b",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            },
            {
              "lessThan": "549e91a9bbaa0ee480f59357868421a61d369770",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.13",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.4",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix handling of lrbp-\u003ecmd\n\nufshcd_queuecommand() may be called two times in a row for a SCSI command\nbefore it is completed. Hence make the following changes:\n\n - In the functions that submit a command, do not check the old value of\n   lrbp-\u003ecmd nor clear lrbp-\u003ecmd in error paths.\n\n - In ufshcd_release_scsi_cmd(), do not clear lrbp-\u003ecmd.\n\nSee also scsi_send_eh_cmnd().\n\nThis commit prevents that the following appears if a command times out:\n\nWARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8\nCall trace:\n ufshcd_queuecommand+0x6f8/0x9a8\n scsi_send_eh_cmnd+0x2c0/0x960\n scsi_eh_test_devices+0x100/0x314\n scsi_eh_ready_devs+0xd90/0x114c\n scsi_error_handler+0x2b4/0xb70\n kthread+0x16c/0x1e0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The affected code is the UFS host controller core driver, reached by submitting SCSI commands to local storage (filesystem I/O, SG_IO on the block device, or /dev/ufs-bsg) and by the kernel SCSI error handler that runs on top of them. There is no network or adjacent-network exposure, and no physical device attachment is needed since UFS is internal soldered storage.\nAC:L - A local attacker drives both halves of the sequence: they queue commands that stall the device (SG_IO lets the caller pick the command timeout, and queue saturation or long-running opcodes reliably produce timeouts), which forces scsi_send_eh_cmnd() to re-submit the same scsi_cmnd at the same tag, and the WARN_ON plus descriptor/PRDT rewrite then follow deterministically. Nothing in the trigger depends on state the attacker cannot influence, and the attempt can be repeated indefinitely.\nPR:L - Only an ordinary local account is needed \u2014 any user generating I/O against UFS-backed storage can have commands in flight that time out, and SG_IO on a readable block device (shell users on embedded/kiosk devices, `disk`-group members) lets the attacker choose the command timeout directly. No root, CAP_SYS_RAWIO, or namespace privilege is required to reach ufshcd_queuecommand() and the SCSI error handler path.\nUI:N - The SCSI error handler thread escalates and re-issues the command automatically once a timeout fires; no victim needs to mount a filesystem, open a file, or take any other action. The attacker\u0027s own I/O is sufficient.\nS:U - The corrupted state (lrbp-\u003ecmd, the transfer request descriptor, PRDT, DMA mappings, hba-\u003edev_cmd.complete) and all resulting damage stay inside the kernel that owns the UFS controller. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Re-programming a transfer descriptor for a tag that is still in the controller doorbell mis-routes completions, so one command\u0027s response UPIU and sense data are delivered as another command\u0027s result, and the spurious complete(hba-\u003edev_cmd.complete) makes ufshcd_wait_for_dev_cmd() read hba-\u003edev_cmd.cqe and lrbp-\u003eucd_rsp_ptr while the controller is still writing them. Combined with the orphaned DMA mapping that leaves the device able to read pages after they are freed and reused, this yields disclosure of arbitrary kernel memory contents.\nI:H - ufshcd_map_sg() calls scsi_dma_map() a second time and rewrites the PRDT for a tag the controller is actively executing, and ufshcd_release_scsi_cmd() unmaps only one of the two mappings \u2014 leaving the UFS controller with DMA write access to pages that are subsequently freed and reallocated. Device-driven writes into reused kernel memory, plus the recycled device-management reserved slot being reprogrammed under an in-flight transfer, constitute kernel memory corruption usable for control-flow hijack.\nA:H - The documented symptom is a WARNING at ufshcd.c:2965 in ufshcd_queuecommand() from the SCSI error handler, which is an immediate kernel panic on the panic_on_warn configurations used by Android GKI, ChromeOS, and hardened embedded builds. Even without panic_on_warn, the descriptor/doorbell confusion and the falsely completed device-management command wedge the UFS error handler and the system\u0027s only storage device."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:32.898Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b6d76d63c6d21d5d26c301a46853a2aee72397d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3ee24af62681b942bbd799ac77b90a6d7e1fdb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/49234a401e161a2f2698f4612ab792c49b3cad1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/549e91a9bbaa0ee480f59357868421a61d369770"
        }
      ],
      "title": "scsi: ufs: core: Fix handling of lrbp-\u003ecmd",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53510",
    "datePublished": "2025-10-01T11:45:59.421Z",
    "dateReserved": "2025-10-01T11:39:39.405Z",
    "dateUpdated": "2026-08-05T09:14:32.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53510",
      "date": "2026-08-11",
      "epss": "0.00144",
      "percentile": "0.04114"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53510\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-01T12:15:54.880\",\"lastModified\":\"2026-08-04T10:19:10.087\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: ufs: core: Fix handling of lrbp-\u003ecmd\\n\\nufshcd_queuecommand() may be called two times in a row for a SCSI command\\nbefore it is completed. Hence make the following changes:\\n\\n - In the functions that submit a command, do not check the old value of\\n   lrbp-\u003ecmd nor clear lrbp-\u003ecmd in error paths.\\n\\n - In ufshcd_release_scsi_cmd(), do not clear lrbp-\u003ecmd.\\n\\nSee also scsi_send_eh_cmnd().\\n\\nThis commit prevents that the following appears if a command times out:\\n\\nWARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8\\nCall trace:\\n ufshcd_queuecommand+0x6f8/0x9a8\\n scsi_send_eh_cmnd+0x2c0/0x960\\n scsi_eh_test_devices+0x100/0x314\\n scsi_eh_ready_devs+0xd90/0x114c\\n scsi_error_handler+0x2b4/0xb70\\n kthread+0x16c/0x1e0\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/ufs/core/ufshcd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5a0b0cb9bee767ef10ff9ce2fb4141af06416288\",\"lessThan\":\"b6d76d63c6d21d5d26c301a46853a2aee72397d5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a0b0cb9bee767ef10ff9ce2fb4141af06416288\",\"lessThan\":\"f3ee24af62681b942bbd799ac77b90a6d7e1fdb1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a0b0cb9bee767ef10ff9ce2fb4141af06416288\",\"lessThan\":\"49234a401e161a2f2698f4612ab792c49b3cad1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a0b0cb9bee767ef10ff9ce2fb4141af06416288\",\"lessThan\":\"549e91a9bbaa0ee480f59357868421a61d369770\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/ufs/core/ufshcd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.167\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.13\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.4\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.12\",\"versionEndExcluding\":\"6.1.167\",\"matchCriteriaId\":\"02E7A70D-F1C7-443F-9AC7-20EDD914F45D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.3.13\",\"matchCriteriaId\":\"95CB4836-7F5D-4C20-B025-8E046EC87B78\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.4.4\",\"matchCriteriaId\":\"6AB81046-CB69-4115-924C-963B37C41385\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/49234a401e161a2f2698f4612ab792c49b3cad1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/549e91a9bbaa0ee480f59357868421a61d369770\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b6d76d63c6d21d5d26c301a46853a2aee72397d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f3ee24af62681b942bbd799ac77b90a6d7e1fdb1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:17:56+00:00",
      "cve": "CVE-2023-53510",
      "id": "CVE-2023-53510",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: ufs: core: Fix handling of lrbp-\u003ecmd",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53510.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T02:17:26Z",
      "cve": "CVE-2023-53510",
      "id": "CVE-2023-53510",
      "initial_release_date": "2025-10-01T23:29:55Z",
      "product_status:known_affected": "648",
      "product_status:known_not_affected": "15",
      "product_status:recommended": "389",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53510",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53510.json",
      "version": "49"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.