PT-2025-38371 · Linux+3 · Linux Kernel+3

CVE-2023-53392 · Publicado 2023-11-07 · Atualizado 2025-09-29

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.16

Description The Linux kernel contained a flaw where a kernel panic could occur during a warm reset. This occurred because the device->fw client was set to NULL during a warm reset. If a bus driver was registered after this NULL setting and before new firmware clients were enumerated, a kernel panic resulted in the ishtp cl bus match() function due to a reference to device->fw client->props.protocol name. The issue was exposed after a change in kernel version 5.16 that loaded bus drivers only for matching devices, specifically with the cros ec ishtp device and driver.

Recommendations Update to kernel version 5.16 or later to resolve this issue.

Exploit

Correção

DoS

Exposure of Resource to Wrong Sphere

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-668

CWE-476

Identificadores relacionados

ALSA-2025_16880

BDU:2026-06024

CESA-2024_3138

CVE-2023-53392

RHSA-2023:6583

RHSA-2023_6583

RHSA-2024:3138

RHSA-2024_3138

Produtos afetados

Astra Linux

Centos

Linux Kernel

Red Hat

Referências · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53392.json · Exploit
• https://git.kernel.org/stable/c/6c8cc40c588f8080a164d88336b1490279e0f1da · Correção
• https://cve.org/CVERecord?id=CVE-2023-53392 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53392 · Aviso do Fabricante
• https://git.kernel.org/stable/c/45b9055a3a3ff6e8c08faad82ea36a8644a81587 · Correção
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53392 · Aviso do Fabricante
• https://lore.kernel.org/linux-cve-announce/2025091858-CVE-2023-53392-9703@gregkh/T · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-53392 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-53392 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-53392 · Aviso do Fabricante
• https://git.kernel.org/stable/c/38518593ec55e897abda4b4be77b2ec8ec4447d1 · Correção
• https://access.redhat.com/security/cve/cve-2023-53392 · Nota
• https://twitter.com/VulmonFeeds/status/1968761935052075279 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1968718124443910212 · Publicação no Twitter
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Nota