CVE-2023-53003
published 2025-03-27CVE-2023-53003: In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
16.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
The memory for llcc_driv_data is allocated by the LLCC driver. But when
it is passed as the private driver info to the EDAC core, it will get freed
during the qcom_edac driver release. So when the qcom_edac driver gets probed
again, it will try to use the freed data leading to the use-after-free bug.
Hence, do not pass llcc_driv_data as pvt_info but rather reference it
using the platform_data pointer in the qcom_edac driver.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.11-1 (bookworm) | linux 6.1.11-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 27450653f1db0b9d5b5048a246c850c52ee4aa61 < 66e10d5f399629ef7877304d9ba2b35d0474e7eb | 66e10d5f399629ef7877304d9ba2b35d0474e7eb |
| linux | linux | >= 27450653f1db0b9d5b5048a246c850c52ee4aa61 < 76d9ebb7f0bc10fbc78b6d576751552edf743968 | 76d9ebb7f0bc10fbc78b6d576751552edf743968 |
| linux | linux | >= 27450653f1db0b9d5b5048a246c850c52ee4aa61 < bff5243bd32661cf9ce66f6d9210fc8f89bda145 | bff5243bd32661cf9ce66f6d9210fc8f89bda145 |
| linux | linux | >= 27450653f1db0b9d5b5048a246c850c52ee4aa61 < 6f0351d0c311951b8b3064db91e61841e85b2b96 | 6f0351d0c311951b8b3064db91e61841e85b2b96 |
| linux | linux | >= 27450653f1db0b9d5b5048a246c850c52ee4aa61 < 977c6ba624f24ae20cf0faee871257a39348d4a9 | 977c6ba624f24ae20cf0faee871257a39348d4a9 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 4.20 < 5.4.231 | 5.4.231 |
| linux | linux_kernel | >= 5.11 < 5.15.91 | 5.15.91 |
| linux | linux_kernel | >= 5.16 < 6.1.9 | 6.1.9 |
| linux | linux_kernel | >= 5.5 < 5.10.166 | 5.10.166 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-53003: In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memor
osv·2025-03-27·CVSS 7.8
CVE-2023-53003 [HIGH] CVE-2023-53003: In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memor
In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the private driver info to the EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driver gets probed again, it will try to use the freed data leading to the use-after-free bug. Hence, do not pass llcc_driv_data as pvt_info but rather reference it using the platform_data pointer in the qcom_edac driver.
GHSA
GHSA-9w4w-6v5v-wh95: In the Linux kernel, the following vulnerability has been resolved:
EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
The mem
ghsa_unreviewed·2025-03-27
CVE-2023-53003 [HIGH] CWE-416 GHSA-9w4w-6v5v-wh95: In the Linux kernel, the following vulnerability has been resolved:
EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
The mem
In the Linux kernel, the following vulnerability has been resolved:
EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
The memory for llcc_driv_data is allocated by the LLCC driver. But when
it is passed as the private driver info to the EDAC core, it will get freed
during the qcom_edac driver release. So when the qcom_edac driver gets probed
again, it will try to use the freed data leading to the use-after-free bug.
Hence, do not pass llcc_driv_data as pvt_info but rather reference it
using the platform_data pointer in the qcom_edac driver.
Red Hat
kernel: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
vendor_redhat·2025-03-27·CVSS 7.8
CVE-2023-53003 [HIGH] CWE-416 kernel: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
kernel: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
In the Linux kernel, the following vulnerability has been resolved:
EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
The memory for llcc_driv_data is allocated by the LLCC driver. But when
it is passed as the private driver info to the EDAC core, it will get freed
during the qcom_edac driver release. So when the qcom_edac driver gets probed
again, it will try to use the freed data leading to the use-after-free bug.
Hence, do not pass llcc_driv_data as pvt_info but rather reference it
using the platform_data pointer in the qcom_edac driver.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat
Debian
CVE-2023-53003: linux - In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: ...
vendor_debian·2023·CVSS 7.8
CVE-2023-53003 [HIGH] CVE-2023-53003: linux - In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: ...
In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the private driver info to the EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driver gets probed again, it will try to use the freed data leading to the use-after-free bug. Hence, do not pass llcc_driv_data as pvt_info but rather reference it using the platform_data pointer in the qcom_edac driver.
Scope: local
bookworm: resolved (fixed in 6.1.11-1)
bullseye: resolved (fixed in 5.10.178-1)
forky: resolved (fixed in 6.1.11-1)
sid: resolved (fixed in 6.1.11-1)
trixie: resolved (fixed in 6.1.11-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/66e10d5f399629ef7877304d9ba2b35d0474e7ebhttps://git.kernel.org/stable/c/6f0351d0c311951b8b3064db91e61841e85b2b96https://git.kernel.org/stable/c/76d9ebb7f0bc10fbc78b6d576751552edf743968https://git.kernel.org/stable/c/977c6ba624f24ae20cf0faee871257a39348d4a9https://git.kernel.org/stable/c/bff5243bd32661cf9ce66f6d9210fc8f89bda145
2025-03-27
Published