cbcvebase.
CVE-2023-53431
published 2025-09-18

CVE-2023-53431: In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Handle enclosure with just a primary component gracefully This reverts commit…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
10.3th percentile
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Handle enclosure with just a primary component gracefully This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") and introduces proper handling of case where there are no detected secondary components, but primary component (enumerated in num_enclosures) does exist. That fix was originally proposed by Ding Hui . Completely ignoring devices that have one primary enclosure and no secondary one results in ses_intf_add() bailing completely scsi 2:0:0:254: enclosure has no enumerated components scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such even on valid configurations with 1 primary and 0 secondary enclosures as below: # sg_ses /dev/sg0 3PARdata SES 3321 Supported diagnostic pages: Supported Diagnostic Pages [sdp] [0x0] Configuration (SES) [cf] [0x1] Short Enclosure Status (SES) [ses] [0x8] # sg_ses -p cf /dev/sg0 3PARdata SES 3321 Configuration diagnostic page: number of secondary subenclosures: 0 generation code: 0x0 enclosure descriptor list Subenclosure identifier: 0 [primary] relative ES process id: 0, number of ES processes: 1 number of type descriptor headers: 1 enclosure logical identifier (hex): 20000002ac02068d enclosure vendor: 3PARdata product: VV rev: 3321 type descriptor header and text list Element type: Unspecified, subenclosure id: 0 number of possible elements: 1 The changelog for the original fix follows We can get a crash when disconnecting the iSCSI session, the call trace like this: [ffff00002a00fb70] kfree at ffff00000830e224 [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4 [ffff00002a00fbd0] device_del at ffff0000086b6a98 [ffff00002a00fc50] device_unregister at ffff0000086b6d58 [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c [ffff00002a00fca0] scsi_remove_device at ffff000008706134 [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4 [ffff00002a00fd10] scsi_remove_targe

Affected

25 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.25-1 (bookworm)linux 6.1.25-1 (bookworm)
linuxlinux
linuxlinux>= 9927c68864e9c39cc317b4f559309ba29e642168 < 4e7c498c3713b09bef20c76c7319555637e8bbd54e7c498c3713b09bef20c76c7319555637e8bbd5
linuxlinux>= 9927c68864e9c39cc317b4f559309ba29e642168 < 110d425cdfb15006f3c4fde5264e786a247b6b36110d425cdfb15006f3c4fde5264e786a247b6b36
linuxlinux>= 9927c68864e9c39cc317b4f559309ba29e642168 < 176d7345b89ced72020a313bfa4e7f345d1c3aed176d7345b89ced72020a313bfa4e7f345d1c3aed
linuxlinux>= 9927c68864e9c39cc317b4f559309ba29e642168 < 05143d90ac90b7abc6692285895a1ef460e008ee05143d90ac90b7abc6692285895a1ef460e008ee
linuxlinux>= 9927c68864e9c39cc317b4f559309ba29e642168 < f8e702c54413eee2d8f94f61d18adadac7c87e87f8e702c54413eee2d8f94f61d18adadac7c87e87
linuxlinux>= 9927c68864e9c39cc317b4f559309ba29e642168 < eabc4872f172ecb8dd8536bc366a51868154a450eabc4872f172ecb8dd8536bc366a51868154a450
linuxlinux>= 9927c68864e9c39cc317b4f559309ba29e642168 < c8e22b7a1694bb8d025ea636816472739d859145c8e22b7a1694bb8d025ea636816472739d859145
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.178-15.10.178-1
linuxlinux_kernel>= 0 < 6.1.25-16.1.25-1
linuxlinux_kernel>= 0 < 6.1.25-16.1.25-1
linuxlinux_kernel>= 0 < 6.1.25-16.1.25-1
linuxlinux_kernel>= 2.6.25 < 4.19.2814.19.281
linuxlinux_kernel>= 4.20 < 5.4.2415.4.241
linuxlinux_kernel>= 5.11 < 5.15.1085.15.108
linuxlinux_kernel>= 5.16 < 6.1.256.1.25
linuxlinux_kernel>= 5.5 < 5.10.1785.10.178
linuxlinux_kernel>= 6.2 < 6.2.126.2.12

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.