CVE-2023-53048

一、漏洞信息
 漏洞编号：[CVE-2023-53048](https://nvd.nist.gov/vuln/detail/CVE-2023-53048)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:usb: typec: tcpm: fix warning when handle discover_identity messageSince both source and sink device can send discover_identity message inPD3, kernel may dump below warning:------------[ cut here ]------------WARNING: CPU: 0 PID: 169 at drivers/usb/typec/tcpm/tcpm.c:1446 tcpm_queue_vdm+0xe0/0xf0Modules linked in:CPU: 0 PID: 169 Comm: 1-0050 Not tainted 6.1.1-00038-g6a3c36cf1da2-dirty #567Hardware name: NXP i.MX8MPlus EVK board (DT)pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)pc : tcpm_queue_vdm+0xe0/0xf0lr : tcpm_queue_vdm+0x2c/0xf0sp : ffff80000c19bcd0x29: ffff80000c19bcd0 x28: 0000000000000001 x27: ffff0000d11c8ab8x26: ffff0000d11cc000 x25: 0000000000000000 x24: 00000000ff008081x23: 0000000000000001 x22: 00000000ff00a081 x21: ffff80000c19bdbcx20: 0000000000000000 x19: ffff0000d11c8080 x18: ffffffffffffffffx17: 0000000000000000 x16: 0000000000000000 x15: ffff0000d716f580x14: 0000000000000001 x13: ffff0000d716f507 x12: 0000000000000001x11: 0000000000000000 x10: 0000000000000020 x9 : 00000000000ee098x8 : 00000000ffffffff x7 : 000000000000001c x6 : ffff0000d716f580x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000x2 : ffff80000c19bdbc x1 : 00000000ff00a081 x0 : 0000000000000004Call trace:tcpm_queue_vdm+0xe0/0xf0tcpm_pd_rx_handler+0x340/0x1ab0kthread_worker_fn+0xcc/0x18ckthread+0x10c/0x110ret_from_fork+0x10/0x20---[ end trace 0000000000000000 ]---Below sequences may trigger this warning:tcpm_send_discover_work(work)  tcpm_send_vdm(port, USB_SID_PD, CMD_DISCOVER_IDENT, NULL, 0);   tcpm_queue_vdm(port, header, data, count);    port->vdm_state = VDM_STATE_READY;vdm_state_machine_work(work);			<-- received discover_identity from partner vdm_run_state_machine(port);  port->vdm_state = VDM_STATE_SEND_MESSAGE;   mod_vdm_delayed_work(port, x);tcpm_pd_rx_handler(work); tcpm_pd_data_request(port, msg);  tcpm_handle_vdm_request(port, msg->payload, cnt);   tcpm_queue_vdm(port, response[0], &response[1], rlen - 1);--> WARN_ON(port->vdm_state > VDM_STATE_DONE);For this case, the state machine could still send out discoveridentity message later if we skip current discover_identity message.So we should handle the received message firstly and override the pendingdiscover_identity message without warning in this case. Then, a delayedsend_discover work will send discover_identity message again.
 漏洞公开时间：2025-05-03 00:15:23
 漏洞创建时间：2025-05-03 01:47:43
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-53048
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/abfc4fa28f0160df61c7149567da4f6494dfb488 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/bb579b3f75c60bf488a7c36e092e8be583407d53 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d55ca2d2ea1a7ec553213986993fba8c0257381c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e37d2c489d71e94ed4a39529bc9520a7fd983d42 |  |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-53048 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-53048 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 5.15.105 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bb579b3f75c60bf488a7c36e092e8be583407d53 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e00943e916782ae17ca05d654779a84f09481ab8 | linuxkernelcves |
| linux_kernel | 6.1.22 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d55ca2d2ea1a7ec553213986993fba8c0257381c | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e00943e916782ae17ca05d654779a84f09481ab8 | linuxkernelcves |
| linux_kernel | 6.2.9 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e37d2c489d71e94ed4a39529bc9520a7fd983d42 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e00943e916782ae17ca05d654779a84f09481ab8 | linuxkernelcves |
| linux_kernel | 6.3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=abfc4fa28f0160df61c7149567da4f6494dfb488 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e00943e916782ae17ca05d654779a84f09481ab8 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:usb: typec: tcpm: fix warning when handle discover_identity messageSince both source and sink device can send discover_identity message inPD3, kernel may dump below warning:------------[ cut here ]------------WARNING: CPU: 0 PID: 169 at drivers/usb/typec/tcpm/tcpm.c:1446 tcpm_queue_vdm+0xe0/0xf0Modules linked in:CPU: 0 PID: 169 Comm: 1-0050 Not tainted 6.1.1-00038-g6a3c36cf1da2-dirty #567Hardware name: NXP i.MX8MPlus EVK board (DT)pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)pc : tcpm_queue_vdm+0xe0/0xf0lr : tcpm_queue_vdm+0x2c/0xf0sp : ffff80000c19bcd0x29: ffff80000c19bcd0 x28: 0000000000000001 x27: ffff0000d11c8ab8x26: ffff0000d11cc000 x25: 0000000000000000 x24: 00000000ff008081x23: 0000000000000001 x22: 00000000ff00a081 x21: ffff80000c19bdbcx20: 0000000000000000 x19: ffff0000d11c8080 x18: ffffffffffffffffx17: 0000000000000000 x16: 0000000000000000 x15: ffff0000d716f580x14: 0000000000000001 x13: ffff0000d716f507 x12: 0000000000000001x11: 0000000000000000 x10: 0000000000000020 x9 : 00000000000ee098x8 : 00000000ffffffff x7 : 000000000000001c x6 : ffff0000d716f580x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000x2 : ffff80000c19bdbc x1 : 00000000ff00a081 x0 : 0000000000000004Call trace:tcpm_queue_vdm+0xe0/0xf0tcpm_pd_rx_handler+0x340/0x1ab0kthread_worker_fn+0xcc/0x18ckthread+0x10c/0x110ret_from_fork+0x10/0x20---[ end trace 0000000000000000 ]---Below sequences may trigger this warning:tcpm_send_discover_work(work)  tcpm_send_vdm(port, USB_SID_PD, CMD_DISCOVER_IDENT, NULL, 0);   tcpm_queue_vdm(port, header, data, count);    port-&gt;vdm_state = VDM_STATE_READY;vdm_state_machine_work(work);&lt;-- received discover_identity from partner vdm_run_state_machine(port);  port-&gt;vdm_state = VDM_STATE_SEND_MESSAGE;   mod_vdm_delayed_work(port, x);tcpm_pd_rx_handler(work); tcpm_pd_data_request(port, msg);  tcpm_handle_vdm_request(port, msg-&gt;payload, cnt);   tcpm_queue_vdm(port, response[0], &#38;response[1], rlen - 1);--&gt; WARN_ON(port-&gt;vdm_state &gt; VDM_STATE_DONE);For this case, the state machine could still send out discoveridentity message later if we skip current discover_identity message.So we should handle the received message firstly and override the pendingdiscover_identity message without warning in this case. Then, a delayedsend_discover work will send discover_identity message again.The Linux kernel CVE team has assigned CVE-2023-53048 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(6.6.0):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.6.0):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
2.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-SP2(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在

src-openEuler/kernel
Closed

Content Risk Flag

Comments (5)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-53048

Comments (5)

Search

src-openEuler/kernel
Closed