cbcvebase.
CVE-2023-53847
published 2025-12-09

CVE-2023-53847: In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alauda_check_media() Syzbot got KMSAN to complain…

PriorityP423low5.5
EPSS
0.21%
11.8th percentile
In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alauda_check_media() Syzbot got KMSAN to complain about access to an uninitialized value in the alauda subdriver of usb-storage: BUG: KMSAN: uninit-value in alauda_transport+0x462/0x57f0 drivers/usb/storage/alauda.c:1137 CPU: 0 PID: 12279 Comm: usb-storage Not tainted 5.3.0-rc7+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x13a/0x2b0 mm/kmsan/kmsan_report.c:108 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:250 alauda_check_media+0x344/0x3310 drivers/usb/storage/alauda.c:460 The problem is that alauda_check_media() doesn't verify that its USB transfer succeeded before trying to use the received data. What should happen if the transfer fails isn't entirely clear, but a reasonably conservative approach is to pretend that no media is present. A similar problem exists in a usb_stor_dbg() call in alauda_get_media_status(). In this case, when an error occurs the call is redundant, because usb_stor_ctrl_transfer() already will print a debugging message. Finally, unrelated to the uninitialized memory access, is the fact that alauda_check_media() performs DMA to a buffer on the stack. Fortunately usb-storage provides a general purpose DMA-able buffer for uses like this. We'll use it instead.

Affected

21 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.52-1 (bookworm)linux 6.1.52-1 (bookworm)
linuxlinux——
linuxlinux>= e80b0fade09ef1ee67b0898d480d4c588f124d5f < 153c3e85873cc3e2f387169783c3a227bad9a95a153c3e85873cc3e2f387169783c3a227bad9a95a
linuxlinux>= e80b0fade09ef1ee67b0898d480d4c588f124d5f < 49d380bcd6cba987c6085fae6464c9c087e8d9a049d380bcd6cba987c6085fae6464c9c087e8d9a0
linuxlinux>= e80b0fade09ef1ee67b0898d480d4c588f124d5f < 044f4446e06bb03c52216697b14867ebc555ad3b044f4446e06bb03c52216697b14867ebc555ad3b
linuxlinux>= e80b0fade09ef1ee67b0898d480d4c588f124d5f < fe7c3a445d22783d27fe8bd0521a8aab1eb9da65fe7c3a445d22783d27fe8bd0521a8aab1eb9da65
linuxlinux>= e80b0fade09ef1ee67b0898d480d4c588f124d5f < 7a11d1e2625bdb2346f6586773b20b20977278ac7a11d1e2625bdb2346f6586773b20b20977278ac
linuxlinux>= e80b0fade09ef1ee67b0898d480d4c588f124d5f < 0d2d5282d39aed6f27dfe1ed60a5f3934ebd21cd0d2d5282d39aed6f27dfe1ed60a5f3934ebd21cd
linuxlinux>= e80b0fade09ef1ee67b0898d480d4c588f124d5f < 373e0ab8c4c516561493f1acf367c7ee7dc053c2373e0ab8c4c516561493f1acf367c7ee7dc053c2
linuxlinux>= e80b0fade09ef1ee67b0898d480d4c588f124d5f < a6ff6e7a9dd69364547751db0f626a10a6d628d2a6ff6e7a9dd69364547751db0f626a10a6d628d2
linuxlinux_kernel>= 0 < 5.10.191-15.10.191-1
linuxlinux_kernel>= 0 < 6.1.52-16.1.52-1
linuxlinux_kernel>= 0 < 6.4.11-16.4.11-1
linuxlinux_kernel>= 0 < 6.4.11-16.4.11-1
linuxlinux_kernel>= 2.6.16 < 4.14.3234.14.323
linuxlinux_kernel>= 4.15.0 < 4.19.2924.19.292
linuxlinux_kernel>= 4.20.0 < 5.4.2545.4.254
linuxlinux_kernel>= 5.11.0 < 5.15.1275.15.127
linuxlinux_kernel>= 5.16.0 < 6.1.466.1.46
linuxlinux_kernel>= 5.5.0 < 5.10.1915.10.191
linuxlinux_kernel>= 6.2.0 < 6.4.116.4.11
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.