CVE-2023-53278
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-12-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.17 (inc) to 6.1.18 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.2.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's UBIFS subsystem, specifically in the ubifs_sysfs_init() function. When the ubifs kernel module (ubifs.ko) is inserted using insmod, a memory leak is reported by kmemleak due to an unreferenced object. The issue occurs because when kset_register() fails, the cleanup function kset_put is not called, leading to the memory not being freed properly.
How can this vulnerability impact me? :
The memory leak can cause increased memory usage over time when the ubifs kernel module is loaded, potentially leading to reduced system performance or stability issues if the leak accumulates. This could affect systems relying on UBIFS for flash storage management, especially in embedded or resource-constrained environments.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kmemleak reports when the ubifs kernel module is inserted using insmod. Specifically, running 'insmod ubifs.ko' and then checking for unreferenced objects related to ubifs in the kmemleak output can indicate the presence of the issue. Commands to use include: 'insmod ubifs.ko' followed by 'cat /sys/kernel/debug/kmemleak' to check for memory leaks.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the fix that ensures kset_put is called to clean up when kset_register() fails during ubifs module initialization. Until a patched kernel is applied, avoid loading the ubifs module with insmod to prevent triggering the memory leak.