CVE-2023-53265

一、漏洞信息
 漏洞编号：[CVE-2023-53265](https://nvd.nist.gov/vuln/detail/CVE-2023-53265)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  A buffer overflow vulnerability exists in the UBI (Unsorted Block Images) subsystem of the Linux kernel. The vulnerability occurs due to insufficient validation of VID header offset and VID header size, which can exceed the allocated area and cause slab buffer overflow. An attacker could exploit this vulnerability to cause kernel crashes or execute arbitrary code.
 漏洞公开时间：2025-09-16 16:15:35
 漏洞创建时间：2025-09-16 17:36:07
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-53265
<details>
<summary>更多参考(点击展开)</summary>

无
</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/61e04db3bec87f7dd10074296deb7d083e2ccade |  | ljqc |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
      In the Linux kernel, the following vulnerability has been resolved:ubi: ensure that VID header offset + VID header size &lt;= alloc, sizeEnsure that the VID header offset + VID header size does not exceedthe allocated area to avoid slab OOB.BUG: KASAN: slab-out-of-bounds in crc32_body lib/crc32.c:111 [inline]BUG: KASAN: slab-out-of-bounds in crc32_le_generic lib/crc32.c:179 [inline]BUG: KASAN: slab-out-of-bounds in crc32_le_base+0x58c/0x626 lib/crc32.c:197Read of size 4 at addr ffff88802bb36f00 by task syz-executor136/1555CPU: 2 PID: 1555 Comm: syz-executor136 Tainted: G        W6.0.0-1868 #1Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7860+a7792d2904/01/2014Call Trace:  &lt;TASK&gt;  __dump_stack lib/dump_stack.c:88 [inline]  dump_stack_lvl+0x85/0xad lib/dump_stack.c:106  print_address_description mm/kasan/report.c:317 [inline]  print_report.cold.13+0xb6/0x6bb mm/kasan/report.c:433  kasan_report+0xa7/0x11b mm/kasan/report.c:495  crc32_body lib/crc32.c:111 [inline]  crc32_le_generic lib/crc32.c:179 [inline]  crc32_le_base+0x58c/0x626 lib/crc32.c:197  ubi_io_write_vid_hdr+0x1b7/0x472 drivers/mtd/ubi/io.c:1067  create_vtbl+0x4d5/0x9c4 drivers/mtd/ubi/vtbl.c:317  create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline]  ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812  ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601  ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965  ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043  vfs_ioctl fs/ioctl.c:51 [inline]  __do_sys_ioctl fs/ioctl.c:870 [inline]  __se_sys_ioctl fs/ioctl.c:856 [inline]  __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x63/0x0RIP: 0033:0x7f96d5cf753dCode:RSP: 002b:00007fffd72206f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96d5cf753dRDX: 0000000020000080 RSI: 0000000040186f40 RDI: 0000000000000003RBP: 0000000000400cd0 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400be0R13: 00007fffd72207e0 R14: 0000000000000000 R15: 0000000000000000  &lt;/TASK&gt;Allocated by task 1555:  kasan_save_stack+0x20/0x3d mm/kasan/common.c:38  kasan_set_track mm/kasan/common.c:45 [inline]  set_alloc_info mm/kasan/common.c:437 [inline]  ____kasan_kmalloc mm/kasan/common.c:516 [inline]  __kasan_kmalloc+0x88/0xa3 mm/kasan/common.c:525  kasan_kmalloc include/linux/kasan.h:234 [inline]  __kmalloc+0x138/0x257 mm/slub.c:4429  kmalloc include/linux/slab.h:605 [inline]  ubi_alloc_vid_buf drivers/mtd/ubi/ubi.h:1093 [inline]  create_vtbl+0xcc/0x9c4 drivers/mtd/ubi/vtbl.c:295  create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline]  ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812  ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601  ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965  ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043  vfs_ioctl fs/ioctl.c:51 [inline]  __do_sys_ioctl fs/ioctl.c:870 [inline]  __se_sys_ioctl fs/ioctl.c:856 [inline]  __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x63/0x0The buggy address belongs to the object at ffff88802bb36e00  which belongs to the cache kmalloc-256 of size 256The buggy address is located 0 bytes to the right of  256-byte region [ffff88802bb36e00, ffff88802bb36f00)The buggy address belongs to the physical page:page:00000000ea4d1263 refcount:1 mapcount:0 mapping:0000000000000000index:0x0 pfn:0x2bb36head:00000000ea4d1263 order:1 compound_mapcount:0 compound_pincount:0flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)raw: 000fffffc0010200 ffffea000066c300 dead000000000003 ffff888100042b40raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000page dumped because: kasan: bad access detectedMemory state around the buggy address:  ffff88802bb36e00: 00 00 00 00 00 00 00 00 00 00 00 00
 openEuler评分：
  7.0
 Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.master(6.12.33):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS:不受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:不受影响
8.openEuler-24.03-LTS-SP2:不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS:不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2553

src-openEuler/kernel
Closed

Content Risk Flag

Comments (5)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-53265

Comments (5)

Search

src-openEuler/kernel
Closed