CVE-2023-53135
published 2025-05-02CVE-2023-53135: In the Linux kernel, the following vulnerability has been resolved: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode When CONFIG_FRAME_POINTER is…
PriorityP429high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.18%
7.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
When CONFIG_FRAME_POINTER is unset, the stack unwinding function
walk_stackframe randomly reads the stack and then, when KASAN is enabled,
it can lead to the following backtrace:
[ 0.000000] ==================================================================
[ 0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a
[ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0
[ 0.000000]
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43
[ 0.000000] Hardware name: riscv-virtio,qemu (DT)
[ 0.000000] Call Trace:
[ 0.000000] [] walk_stackframe+0x0/0x11a
[ 0.000000] [] init_param_lock+0x26/0x2a
[ 0.000000] [] walk_stackframe+0xa2/0x11a
[ 0.000000] [] dump_stack_lvl+0x22/0x36
[ 0.000000] [] print_report+0x198/0x4a8
[ 0.000000] [] init_param_lock+0x26/0x2a
[ 0.000000] [] walk_stackframe+0xa2/0x11a
[ 0.000000] [] kasan_report+0x9a/0xc8
[ 0.000000] [] walk_stackframe+0xa2/0x11a
[ 0.000000] [] walk_stackframe+0xa2/0x11a
[ 0.000000] [] desc_make_final+0x80/0x84
[ 0.000000] [] stack_trace_save+0x88/0xa6
[ 0.000000] [] filter_irq_stacks+0x72/0x76
[ 0.000000] [] devkmsg_read+0x32a/0x32e
[ 0.000000] [] kasan_save_stack+0x28/0x52
[ 0.000000] [] desc_make_final+0x7c/0x84
[ 0.000000] [] stack_trace_save+0x84/0xa6
[ 0.000000] [] kasan_set_track+0x12/0x20
[ 0.000000] [] __kasan_slab_alloc+0x58/0x5e
[ 0.000000] [] __kmem_cache_create+0x21e/0x39a
[ 0.000000] [] create_boot_cache+0x70/0x9c
[ 0.000000] [] kmem_cache_init+0x6c/0x11e
[ 0.000000] [] mm_init+0xd8/0xfe
[ 0.000000] [] start_kernel+0x190/0x3ca
[ 0.000000]
[ 0.000000] The buggy address belongs to stack of task swapper/0
[ 0.000000] and is located at offset 0 in frame:
[ 0.000000] stack_trace_save+0x0/0xa6
[ 0.000000]
[ 0.000000] This frame has 1 object:
[ 0.000000] [32, 56) 'c'
[ 0.000000]
[ 0.000000] The buggy address belongs to the physical pa
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.20-1 (bookworm) | linux 6.1.20-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 5d8544e2d0075a5f3c9a2cf27152354d54360da1 < a99a61d9e1bfca2fc37d223a6a185c0eb66aba02 | a99a61d9e1bfca2fc37d223a6a185c0eb66aba02 |
| linux | linux | >= 5d8544e2d0075a5f3c9a2cf27152354d54360da1 < 3de277af481ab931fab9e295ad8762692920732a | 3de277af481ab931fab9e295ad8762692920732a |
| linux | linux | >= 5d8544e2d0075a5f3c9a2cf27152354d54360da1 < 3a9418d2c93c1c86ce4d0595112d91c7a8e70c2c | 3a9418d2c93c1c86ce4d0595112d91c7a8e70c2c |
| linux | linux | >= 5d8544e2d0075a5f3c9a2cf27152354d54360da1 < 324912d6c0c4006711054d389faa2239c1655e1e | 324912d6c0c4006711054d389faa2239c1655e1e |
| linux | linux | >= 5d8544e2d0075a5f3c9a2cf27152354d54360da1 < 17fa90ffba20743c946920fbb0afe160d0ead8c9 | 17fa90ffba20743c946920fbb0afe160d0ead8c9 |
| linux | linux | >= 5d8544e2d0075a5f3c9a2cf27152354d54360da1 < 76950340cf03b149412fe0d5f0810e52ac1df8cb | 76950340cf03b149412fe0d5f0810e52ac1df8cb |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 4.15 < 5.4.237 | 5.4.237 |
| linux | linux_kernel | >= 5.11 < 5.15.103 | 5.15.103 |
| linux | linux_kernel | >= 5.16 < 6.1.20 | 6.1.20 |
| linux | linux_kernel | >= 5.5 < 5.10.175 | 5.10.175 |
| linux | linux_kernel | >= 6.2 < 6.2.7 | 6.2.7 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
vendor_redhat·2025-05-02·CVSS 7.1
CVE-2023-53135 [HIGH] kernel: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
kernel: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
In the Linux kernel, the following vulnerability has been resolved:
riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
When CONFIG_FRAME_POINTER is unset, the stack unwinding function
walk_stackframe randomly reads the stack and then, when KASAN is enabled,
it can lead to the following backtrace:
[ 0.000000] ==================================================================
[ 0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a
[ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0
[ 0.000000]
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43
[ 0.000000] Hardware name: riscv-virtio,qemu (DT)
[ 0.000000] Call Trace:
[ 0.000000] [] walk_stackfr
Debian
CVE-2023-53135: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: Use ...
vendor_debian·2023·CVSS 7.1
CVE-2023-53135 [HIGH] CVE-2023-53135: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: Use ...
In the Linux kernel, the following vulnerability has been resolved: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode When CONFIG_FRAME_POINTER is unset, the stack unwinding function walk_stackframe randomly reads the stack and then, when KASAN is enabled, it can lead to the following backtrace: [ 0.000000] ================================================================== [ 0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a [ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0 [ 0.000000] [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43 [ 0.000000] Hardware name: riscv-virtio,qemu (DT) [ 0.000000] Call Trace: [ 0.000000] [] walk_stackframe+0x0/0x11a [ 0.000000] [] init_param_lock+0x26/0x2a [ 0.000000] [] wa
GHSA
GHSA-2c79-g4hv-82qp: In the Linux kernel, the following vulnerability has been resolved:
riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
When CONFIG_FRAME
ghsa_unreviewed·2025-05-02
CVE-2023-53135 [HIGH] CWE-125 GHSA-2c79-g4hv-82qp: In the Linux kernel, the following vulnerability has been resolved:
riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
When CONFIG_FRAME
In the Linux kernel, the following vulnerability has been resolved:
riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
When CONFIG_FRAME_POINTER is unset, the stack unwinding function
walk_stackframe randomly reads the stack and then, when KASAN is enabled,
it can lead to the following backtrace:
[ 0.000000] ==================================================================
[ 0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a
[ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0
[ 0.000000]
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43
[ 0.000000] Hardware name: riscv-virtio,qemu (DT)
[ 0.000000] Call Trace:
[ 0.000000] [] walk_stackframe+0x0/0x11a
[ 0.000000] [] init_param_lock+0x26/0x2a
[ 0.000000] []
OSV
CVE-2023-53135: In the Linux kernel, the following vulnerability has been resolved: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode When CONFIG_FRAME_P
osv·2025-05-02·CVSS 7.1
CVE-2023-53135 [HIGH] CVE-2023-53135: In the Linux kernel, the following vulnerability has been resolved: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode When CONFIG_FRAME_P
In the Linux kernel, the following vulnerability has been resolved: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode When CONFIG_FRAME_POINTER is unset, the stack unwinding function walk_stackframe randomly reads the stack and then, when KASAN is enabled, it can lead to the following backtrace: [ 0.000000] ================================================================== [ 0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a [ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0 [ 0.000000] [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43 [ 0.000000] Hardware name: riscv-virtio,qemu (DT) [ 0.000000] Call Trace: [ 0.000000] [] walk_stackframe+0x0/0x11a [ 0.000000] [] init_param_lock+0x26/0x2a [ 0.000000] [] wa
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/17fa90ffba20743c946920fbb0afe160d0ead8c9https://git.kernel.org/stable/c/324912d6c0c4006711054d389faa2239c1655e1ehttps://git.kernel.org/stable/c/3a9418d2c93c1c86ce4d0595112d91c7a8e70c2chttps://git.kernel.org/stable/c/3de277af481ab931fab9e295ad8762692920732ahttps://git.kernel.org/stable/c/76950340cf03b149412fe0d5f0810e52ac1df8cbhttps://git.kernel.org/stable/c/a99a61d9e1bfca2fc37d223a6a185c0eb66aba02
2025-05-02
Published