CVE-2023-53783
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid setting the io.cost.model rbps value to the maximum u64 value (18446744073709551615) or any value that could cause an overflow. Apply the patch or update the Linux kernel to the fixed version where the divide by zero error in calc_lcoefs() is resolved by setting basecost properly.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the system's io.cost.model cgroup parameter has been set to an extremely large value (such as 18446744073709551615) which can cause a divide by zero error in the kernel. You can inspect the value by running the command: cat /sys/fs/cgroup/io.cost.model. Additionally, attempting to write a very large value to this file (e.g., echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model) in a controlled test environment may reproduce the divide by zero error and kernel crash, indicating the vulnerability. Monitoring kernel logs (e.g., dmesg) for divide error messages referencing calc_lcoefs can also help detect exploitation attempts.
Can you explain this vulnerability to me?
This vulnerability is a divide by zero error in the Linux kernel's blk-iocost subsystem, specifically in the function calc_lcoefs(). It occurs when an extremely large value (the maximum unsigned 64-bit integer) is written to the io.cost.model parameter, causing an overflow that leads to a division by zero error. This can cause the kernel to crash or behave unexpectedly.
How can this vulnerability impact me? :
The vulnerability can cause a kernel crash or system instability due to a divide by zero error when handling certain input values in the io.cost.model parameter. This could lead to denial of service or unexpected behavior in systems running the affected Linux kernel.