ghsa-w6pv-gx3q-3r57
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix device management cmd timeout flow
In the UFS error handling flow, the host will send a device management cmd (NOP OUT) to the device for link recovery. If this cmd times out and clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and return. hba->dev_cmd.complete struct is not set to NULL.
When this happens, if cmd has been completed by device, then we will call complete() in __ufshcd_transfer_req_compl(). Because the complete struct is allocated on the stack, the following crash will occur:
ipanic_die+0x24/0x38 [mrdump] die+0x344/0x748 arm64_notify_die+0x44/0x104 do_debug_exception+0x104/0x1e0 el1_dbg+0x38/0x54 el1_sync_handler+0x40/0x88 el1_sync+0x8c/0x140 queued_spin_lock_slowpath+0x2e4/0x3c0 __ufshcd_transfer_req_compl+0x3b0/0x1164 ufshcd_trc_handler+0x15c/0x308 ufshcd_host_reset_and_restore+0x54/0x260 ufshcd_reset_and_restore+0x28c/0x57c ufshcd_err_handler+0xeb8/0x1b6c process_one_work+0x288/0x964 worker_thread+0x4bc/0xc7c kthread+0x15c/0x264 ret_from_fork+0x10/0x30
{
"affected": [],
"aliases": [
"CVE-2023-53387"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-18T14:15:41Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix device management cmd timeout flow\n\nIn the UFS error handling flow, the host will send a device management cmd\n(NOP OUT) to the device for link recovery. If this cmd times out and\nclearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and\nreturn. hba-\u003edev_cmd.complete struct is not set to NULL.\n\nWhen this happens, if cmd has been completed by device, then we will call\ncomplete() in __ufshcd_transfer_req_compl(). Because the complete struct is\nallocated on the stack, the following crash will occur:\n\n ipanic_die+0x24/0x38 [mrdump]\n die+0x344/0x748\n arm64_notify_die+0x44/0x104\n do_debug_exception+0x104/0x1e0\n el1_dbg+0x38/0x54\n el1_sync_handler+0x40/0x88\n el1_sync+0x8c/0x140\n queued_spin_lock_slowpath+0x2e4/0x3c0\n __ufshcd_transfer_req_compl+0x3b0/0x1164\n ufshcd_trc_handler+0x15c/0x308\n ufshcd_host_reset_and_restore+0x54/0x260\n ufshcd_reset_and_restore+0x28c/0x57c\n ufshcd_err_handler+0xeb8/0x1b6c\n process_one_work+0x288/0x964\n worker_thread+0x4bc/0xc7c\n kthread+0x15c/0x264\n ret_from_fork+0x10/0x30",
"id": "GHSA-w6pv-gx3q-3r57",
"modified": "2025-09-18T15:30:34Z",
"published": "2025-09-18T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53387"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/36822124f9de200cedc2f42516301b50d386a6cd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3ffd2cd644e0f1eea01339831bac4b1054e8817c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cf45493432704786a0f8294c7723ad4eeb5fff24"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.