CVE-2023-53536 (GCVE-0-2023-53536)
Vulnerability from cvelistv5
Published
2025-10-04 15:16
Modified
2025-10-04 15:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
blk-crypto: make blk_crypto_evict_key() more robust
If blk_crypto_evict_key() sees that the key is still in-use (due to a
bug) or that ->keyslot_evict failed, it currently just returns while
leaving the key linked into the keyslot management structures.
However, blk_crypto_evict_key() is only called in contexts such as inode
eviction where failure is not an option. So actually the caller
proceeds with freeing the blk_crypto_key regardless of the return value
of blk_crypto_evict_key().
These two assumptions don't match, and the result is that there can be a
use-after-free in blk_crypto_reprogram_all_keys() after one of these
errors occurs. (Note, these errors *shouldn't* happen; we're just
talking about what happens if they do anyway.)
Fix this by making blk_crypto_evict_key() unlink the key from the
keyslot management structures even on failure.
Also improve some comments.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1b2628397058ebce7277480960b29c788138de90 Version: 1b2628397058ebce7277480960b29c788138de90 Version: 1b2628397058ebce7277480960b29c788138de90 Version: 1b2628397058ebce7277480960b29c788138de90 Version: 1b2628397058ebce7277480960b29c788138de90 Version: 1b2628397058ebce7277480960b29c788138de90 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-crypto-profile.c",
"block/blk-crypto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "701a8220762ff90615dc91d3543f789391b63298",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
},
{
"lessThan": "5bb4005fb667c6e2188fa87950f8d5faf2994410",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
},
{
"lessThan": "64ef787bb1588475163069c2e62fdd8f6c27b1f6",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
},
{
"lessThan": "809a5be62e92a444a3c3d7b9f438019d0b322f55",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
},
{
"lessThan": "5c62852942667c613de0458fc797c5b8c36112b5",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
},
{
"lessThan": "5c7cb94452901a93e90c2230632e2c12a681bc92",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-crypto-profile.c",
"block/blk-crypto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.180",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.111",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.28",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.15",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-crypto: make blk_crypto_evict_key() more robust\n\nIf blk_crypto_evict_key() sees that the key is still in-use (due to a\nbug) or that -\u003ekeyslot_evict failed, it currently just returns while\nleaving the key linked into the keyslot management structures.\n\nHowever, blk_crypto_evict_key() is only called in contexts such as inode\neviction where failure is not an option. So actually the caller\nproceeds with freeing the blk_crypto_key regardless of the return value\nof blk_crypto_evict_key().\n\nThese two assumptions don\u0027t match, and the result is that there can be a\nuse-after-free in blk_crypto_reprogram_all_keys() after one of these\nerrors occurs. (Note, these errors *shouldn\u0027t* happen; we\u0027re just\ntalking about what happens if they do anyway.)\n\nFix this by making blk_crypto_evict_key() unlink the key from the\nkeyslot management structures even on failure.\n\nAlso improve some comments."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:47.304Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/701a8220762ff90615dc91d3543f789391b63298"
},
{
"url": "https://git.kernel.org/stable/c/5bb4005fb667c6e2188fa87950f8d5faf2994410"
},
{
"url": "https://git.kernel.org/stable/c/64ef787bb1588475163069c2e62fdd8f6c27b1f6"
},
{
"url": "https://git.kernel.org/stable/c/809a5be62e92a444a3c3d7b9f438019d0b322f55"
},
{
"url": "https://git.kernel.org/stable/c/5c62852942667c613de0458fc797c5b8c36112b5"
},
{
"url": "https://git.kernel.org/stable/c/5c7cb94452901a93e90c2230632e2c12a681bc92"
}
],
"title": "blk-crypto: make blk_crypto_evict_key() more robust",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53536",
"datePublished": "2025-10-04T15:16:47.304Z",
"dateReserved": "2025-10-04T15:14:15.919Z",
"dateUpdated": "2025-10-04T15:16:47.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-53536\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-04T16:15:48.580\",\"lastModified\":\"2025-10-06T14:56:21.733\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-crypto: make blk_crypto_evict_key() more robust\\n\\nIf blk_crypto_evict_key() sees that the key is still in-use (due to a\\nbug) or that -\u003ekeyslot_evict failed, it currently just returns while\\nleaving the key linked into the keyslot management structures.\\n\\nHowever, blk_crypto_evict_key() is only called in contexts such as inode\\neviction where failure is not an option. So actually the caller\\nproceeds with freeing the blk_crypto_key regardless of the return value\\nof blk_crypto_evict_key().\\n\\nThese two assumptions don\u0027t match, and the result is that there can be a\\nuse-after-free in blk_crypto_reprogram_all_keys() after one of these\\nerrors occurs. (Note, these errors *shouldn\u0027t* happen; we\u0027re just\\ntalking about what happens if they do anyway.)\\n\\nFix this by making blk_crypto_evict_key() unlink the key from the\\nkeyslot management structures even on failure.\\n\\nAlso improve some comments.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5bb4005fb667c6e2188fa87950f8d5faf2994410\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5c62852942667c613de0458fc797c5b8c36112b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5c7cb94452901a93e90c2230632e2c12a681bc92\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/64ef787bb1588475163069c2e62fdd8f6c27b1f6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/701a8220762ff90615dc91d3543f789391b63298\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/809a5be62e92a444a3c3d7b9f438019d0b322f55\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}