CVE-2023-53431
published 2025-09-18CVE-2023-53431: In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Handle enclosure with just a primary component gracefully This reverts commit…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
10.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
scsi: ses: Handle enclosure with just a primary component gracefully
This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure
has no components") and introduces proper handling of case where there are
no detected secondary components, but primary component (enumerated in
num_enclosures) does exist. That fix was originally proposed by Ding Hui
.
Completely ignoring devices that have one primary enclosure and no
secondary one results in ses_intf_add() bailing completely
scsi 2:0:0:254: enclosure has no enumerated components
scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such
even on valid configurations with 1 primary and 0 secondary enclosures as
below:
# sg_ses /dev/sg0
3PARdata SES 3321
Supported diagnostic pages:
Supported Diagnostic Pages [sdp] [0x0]
Configuration (SES) [cf] [0x1]
Short Enclosure Status (SES) [ses] [0x8]
# sg_ses -p cf /dev/sg0
3PARdata SES 3321
Configuration diagnostic page:
number of secondary subenclosures: 0
generation code: 0x0
enclosure descriptor list
Subenclosure identifier: 0 [primary]
relative ES process id: 0, number of ES processes: 1
number of type descriptor headers: 1
enclosure logical identifier (hex): 20000002ac02068d
enclosure vendor: 3PARdata product: VV rev: 3321
type descriptor header and text list
Element type: Unspecified, subenclosure id: 0
number of possible elements: 1
The changelog for the original fix follows
We can get a crash when disconnecting the iSCSI session,
the call trace like this:
[ffff00002a00fb70] kfree at ffff00000830e224
[ffff00002a00fba0] ses_intf_remove at ffff000001f200e4
[ffff00002a00fbd0] device_del at ffff0000086b6a98
[ffff00002a00fc50] device_unregister at ffff0000086b6d58
[ffff00002a00fc70] __scsi_remove_device at ffff00000870608c
[ffff00002a00fca0] scsi_remove_device at ffff000008706134
[ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4
[ffff00002a00fd10] scsi_remove_targe
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.25-1 (bookworm) | linux 6.1.25-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 9927c68864e9c39cc317b4f559309ba29e642168 < 4e7c498c3713b09bef20c76c7319555637e8bbd5 | 4e7c498c3713b09bef20c76c7319555637e8bbd5 |
| linux | linux | >= 9927c68864e9c39cc317b4f559309ba29e642168 < 110d425cdfb15006f3c4fde5264e786a247b6b36 | 110d425cdfb15006f3c4fde5264e786a247b6b36 |
| linux | linux | >= 9927c68864e9c39cc317b4f559309ba29e642168 < 176d7345b89ced72020a313bfa4e7f345d1c3aed | 176d7345b89ced72020a313bfa4e7f345d1c3aed |
| linux | linux | >= 9927c68864e9c39cc317b4f559309ba29e642168 < 05143d90ac90b7abc6692285895a1ef460e008ee | 05143d90ac90b7abc6692285895a1ef460e008ee |
| linux | linux | >= 9927c68864e9c39cc317b4f559309ba29e642168 < f8e702c54413eee2d8f94f61d18adadac7c87e87 | f8e702c54413eee2d8f94f61d18adadac7c87e87 |
| linux | linux | >= 9927c68864e9c39cc317b4f559309ba29e642168 < eabc4872f172ecb8dd8536bc366a51868154a450 | eabc4872f172ecb8dd8536bc366a51868154a450 |
| linux | linux | >= 9927c68864e9c39cc317b4f559309ba29e642168 < c8e22b7a1694bb8d025ea636816472739d859145 | c8e22b7a1694bb8d025ea636816472739d859145 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 2.6.25 < 4.19.281 | 4.19.281 |
| linux | linux_kernel | >= 4.20 < 5.4.241 | 5.4.241 |
| linux | linux_kernel | >= 5.11 < 5.15.108 | 5.15.108 |
| linux | linux_kernel | >= 5.16 < 6.1.25 | 6.1.25 |
| linux | linux_kernel | >= 5.5 < 5.10.178 | 5.10.178 |
| linux | linux_kernel | >= 6.2 < 6.2.12 | 6.2.12 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-36rm-q238-p59m: In the Linux kernel, the following vulnerability has been resolved:
scsi: ses: Don't attach if enclosure has no components
An enclosure with no comp
ghsa_unreviewed·2025-09-18
CVE-2023-53431 [MEDIUM] GHSA-36rm-q238-p59m: In the Linux kernel, the following vulnerability has been resolved:
scsi: ses: Don't attach if enclosure has no components
An enclosure with no comp
In the Linux kernel, the following vulnerability has been resolved:
scsi: ses: Don't attach if enclosure has no components
An enclosure with no components can't usefully be operated by the driver
(since effectively it has nothing to manage), so report the problem and
don't attach. Not attaching also fixes an oops which could occur if the
driver tries to manage a zero component enclosure.
[mkp: Switched to KERN_WARNING since this scenario is common]
OSV
CVE-2023-53431: In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Handle enclosure with just a primary component gracefully This reverts
osv·2025-09-18·CVSS 5.5
CVE-2023-53431 [MEDIUM] CVE-2023-53431: In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Handle enclosure with just a primary component gracefully This reverts
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Handle enclosure with just a primary component gracefully This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") and introduces proper handling of case where there are no detected secondary components, but primary component (enumerated in num_enclosures) does exist. That fix was originally proposed by Ding Hui . Completely ignoring devices that have one primary enclosure and no secondary one results in ses_intf_add() bailing completely scsi 2:0:0:254: enclosure has no enumerated components scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such even on valid configurations with 1 primary and 0 secondary enclosures as below: # sg_ses /dev/sg0 3PARdata SES
Red Hat
kernel: Linux kernel: Denial of Service in scsi_ses due to enclosure with no components
vendor_redhat·2025-09-18·CVSS 5.5
CVE-2023-53431 [MEDIUM] CWE-1285 kernel: Linux kernel: Denial of Service in scsi_ses due to enclosure with no components
kernel: Linux kernel: Denial of Service in scsi_ses due to enclosure with no components
In the Linux kernel, the following vulnerability has been resolved:
scsi: ses: Handle enclosure with just a primary component gracefully
This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure
has no components") and introduces proper handling of case where there are
no detected secondary components, but primary component (enumerated in
num_enclosures) does exist. That fix was originally proposed by Ding Hui
.
Completely ignoring devices that have one primary enclosure and no
secondary one results in ses_intf_add() bailing completely
scsi 2:0:0:254: enclosure has no enumerated components
scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such
even on valid configura
Debian
CVE-2023-53431: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: ses: ...
vendor_debian·2023·CVSS 5.5
CVE-2023-53431 [MEDIUM] CVE-2023-53431: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: ses: ...
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Handle enclosure with just a primary component gracefully This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") and introduces proper handling of case where there are no detected secondary components, but primary component (enumerated in num_enclosures) does exist. That fix was originally proposed by Ding Hui . Completely ignoring devices that have one primary enclosure and no secondary one results in ses_intf_add() bailing completely scsi 2:0:0:254: enclosure has no enumerated components scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such even on valid configurations with 1 primary and 0 secondary enclosures as below: # sg_ses /dev/sg0 3PARdata SES
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/05143d90ac90b7abc6692285895a1ef460e008eehttps://git.kernel.org/stable/c/110d425cdfb15006f3c4fde5264e786a247b6b36https://git.kernel.org/stable/c/176d7345b89ced72020a313bfa4e7f345d1c3aedhttps://git.kernel.org/stable/c/4e7c498c3713b09bef20c76c7319555637e8bbd5https://git.kernel.org/stable/c/c8e22b7a1694bb8d025ea636816472739d859145https://git.kernel.org/stable/c/eabc4872f172ecb8dd8536bc366a51868154a450https://git.kernel.org/stable/c/f8e702c54413eee2d8f94f61d18adadac7c87e87
2025-09-18
Published