CVE-2023-52608 (GCVE-0-2023-52608)

Vulnerability from cvelistv5 – Published: 2024-03-13 14:01 – Updated: 2026-05-11 19:30
VLAI
Title
firmware: arm_scmi: Check mailbox/SMT channel for consistency
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Check mailbox/SMT channel for consistency On reception of a completion interrupt the shared memory area is accessed to retrieve the message header at first and then, if the message sequence number identifies a transaction which is still pending, the related payload is fetched too. When an SCMI command times out the channel ownership remains with the platform until eventually a late reply is received and, as a consequence, any further transmission attempt remains pending, waiting for the channel to be relinquished by the platform. Once that late reply is received the channel ownership is given back to the agent and any pending request is then allowed to proceed and overwrite the SMT area of the just delivered late reply; then the wait for the reply to the new request starts. It has been observed that the spurious IRQ related to the late reply can be wrongly associated with the freshly enqueued request: when that happens the SCMI stack in-flight lookup procedure is fooled by the fact that the message header now present in the SMT area is related to the new pending transaction, even though the real reply has still to arrive. This race-condition on the A2P channel can be detected by looking at the channel status bits: a genuine reply from the platform will have set the channel free bit before triggering the completion IRQ. Add a consistency check to validate such condition in the A2P ISR.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac , < 614cc65032dcb0b64d23f5c5e338a8a04b12be5d (git)
Affected: 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac , < 7f95f6997f4fdd17abec3200cae45420a5489350 (git)
Affected: 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac , < 9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2 (git)
Affected: 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac , < 12dc4217f16551d6dee9cbefc23fdb5659558cda (git)
Affected: 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac , < 437a310b22244d4e0b78665c3042e5d1c0f45306 (git)
Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.15.149 , ≤ 5.15.* (semver)
Unaffected: 6.1.76 , ≤ 6.1.* (semver)
Unaffected: 6.6.15 , ≤ 6.6.* (semver)
Unaffected: 6.7.3 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52608",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-06T17:50:57.700750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-06T17:51:11.177Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:21.210Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/614cc65032dcb0b64d23f5c5e338a8a04b12be5d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7f95f6997f4fdd17abec3200cae45420a5489350"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/12dc4217f16551d6dee9cbefc23fdb5659558cda"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/437a310b22244d4e0b78665c3042e5d1c0f45306"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scmi/common.h",
            "drivers/firmware/arm_scmi/mailbox.c",
            "drivers/firmware/arm_scmi/shmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "614cc65032dcb0b64d23f5c5e338a8a04b12be5d",
              "status": "affected",
              "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
              "versionType": "git"
            },
            {
              "lessThan": "7f95f6997f4fdd17abec3200cae45420a5489350",
              "status": "affected",
              "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
              "versionType": "git"
            },
            {
              "lessThan": "9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2",
              "status": "affected",
              "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
              "versionType": "git"
            },
            {
              "lessThan": "12dc4217f16551d6dee9cbefc23fdb5659558cda",
              "status": "affected",
              "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
              "versionType": "git"
            },
            {
              "lessThan": "437a310b22244d4e0b78665c3042e5d1c0f45306",
              "status": "affected",
              "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scmi/common.h",
            "drivers/firmware/arm_scmi/mailbox.c",
            "drivers/firmware/arm_scmi/shmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.76",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.15",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Check mailbox/SMT channel for consistency\n\nOn reception of a completion interrupt the shared memory area is accessed\nto retrieve the message header at first and then, if the message sequence\nnumber identifies a transaction which is still pending, the related\npayload is fetched too.\n\nWhen an SCMI command times out the channel ownership remains with the\nplatform until eventually a late reply is received and, as a consequence,\nany further transmission attempt remains pending, waiting for the channel\nto be relinquished by the platform.\n\nOnce that late reply is received the channel ownership is given back\nto the agent and any pending request is then allowed to proceed and\noverwrite the SMT area of the just delivered late reply; then the wait\nfor the reply to the new request starts.\n\nIt has been observed that the spurious IRQ related to the late reply can\nbe wrongly associated with the freshly enqueued request: when that happens\nthe SCMI stack in-flight lookup procedure is fooled by the fact that the\nmessage header now present in the SMT area is related to the new pending\ntransaction, even though the real reply has still to arrive.\n\nThis race-condition on the A2P channel can be detected by looking at the\nchannel status bits: a genuine reply from the platform will have set the\nchannel free bit before triggering the completion IRQ.\n\nAdd a consistency check to validate such condition in the A2P ISR."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:30:16.364Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/614cc65032dcb0b64d23f5c5e338a8a04b12be5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f95f6997f4fdd17abec3200cae45420a5489350"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/12dc4217f16551d6dee9cbefc23fdb5659558cda"
        },
        {
          "url": "https://git.kernel.org/stable/c/437a310b22244d4e0b78665c3042e5d1c0f45306"
        }
      ],
      "title": "firmware: arm_scmi: Check mailbox/SMT channel for consistency",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52608",
    "datePublished": "2024-03-13T14:01:48.870Z",
    "dateReserved": "2024-03-02T21:55:42.574Z",
    "dateUpdated": "2026-05-11T19:30:16.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52608",
      "date": "2026-07-16",
      "epss": "0.00174",
      "percentile": "0.07072"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52608\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-13T14:15:07.240\",\"lastModified\":\"2026-06-17T06:43:08.920\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: arm_scmi: Check mailbox/SMT channel for consistency\\n\\nOn reception of a completion interrupt the shared memory area is accessed\\nto retrieve the message header at first and then, if the message sequence\\nnumber identifies a transaction which is still pending, the related\\npayload is fetched too.\\n\\nWhen an SCMI command times out the channel ownership remains with the\\nplatform until eventually a late reply is received and, as a consequence,\\nany further transmission attempt remains pending, waiting for the channel\\nto be relinquished by the platform.\\n\\nOnce that late reply is received the channel ownership is given back\\nto the agent and any pending request is then allowed to proceed and\\noverwrite the SMT area of the just delivered late reply; then the wait\\nfor the reply to the new request starts.\\n\\nIt has been observed that the spurious IRQ related to the late reply can\\nbe wrongly associated with the freshly enqueued request: when that happens\\nthe SCMI stack in-flight lookup procedure is fooled by the fact that the\\nmessage header now present in the SMT area is related to the new pending\\ntransaction, even though the real reply has still to arrive.\\n\\nThis race-condition on the A2P channel can be detected by looking at the\\nchannel status bits: a genuine reply from the platform will have set the\\nchannel free bit before triggering the completion IRQ.\\n\\nAdd a consistency check to validate such condition in the A2P ISR.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_scmi: comprueba la coherencia del buz\u00f3n/canal SMT Al recibir una interrupci\u00f3n de finalizaci\u00f3n, se accede al \u00e1rea de memoria compartida para recuperar el encabezado del mensaje al principio y luego, si el n\u00famero de secuencia del mensaje identifica una transacci\u00f3n que a\u00fan est\u00e1 pendiente, el payload relacionado tambi\u00e9n se recupera. Cuando se agota el tiempo de espera de un comando SCMI, la propiedad del canal permanece en la plataforma hasta que finalmente se recibe una respuesta tard\u00eda y, como consecuencia, cualquier intento de transmisi\u00f3n adicional permanece pendiente, esperando que la plataforma abandone el canal. Una vez que se recibe esa respuesta tard\u00eda, la propiedad del canal se devuelve al agente y cualquier solicitud pendiente puede continuar y sobrescribir el \u00e1rea SMT de la respuesta tard\u00eda reci\u00e9n entregada; luego comienza la espera de la respuesta a la nueva solicitud. Se ha observado que la IRQ espuria relacionada con la respuesta tard\u00eda puede asociarse err\u00f3neamente con la solicitud reci\u00e9n puesta en cola: cuando eso sucede, el procedimiento de b\u00fasqueda en curso de la pila SCMI se ve enga\u00f1ado por el hecho de que el encabezado del mensaje ahora presente en el \u00e1rea SMT es relacionado con la nueva transacci\u00f3n pendiente, aunque la respuesta real a\u00fan no ha llegado. Esta condici\u00f3n de ejecuci\u00f3n en el canal A2P se puede detectar observando los bits de estado del canal: una respuesta genuina de la plataforma habr\u00e1 configurado el bit libre del canal antes de activar la IRQ de finalizaci\u00f3n. Agregue una verificaci\u00f3n de coherencia para validar dicha condici\u00f3n en el ISR A2P.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/firmware/arm_scmi/common.h\",\"drivers/firmware/arm_scmi/mailbox.c\",\"drivers/firmware/arm_scmi/shmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\",\"lessThan\":\"614cc65032dcb0b64d23f5c5e338a8a04b12be5d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\",\"lessThan\":\"7f95f6997f4fdd17abec3200cae45420a5489350\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\",\"lessThan\":\"9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\",\"lessThan\":\"12dc4217f16551d6dee9cbefc23fdb5659558cda\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\",\"lessThan\":\"437a310b22244d4e0b78665c3042e5d1c0f45306\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/firmware/arm_scmi/common.h\",\"drivers/firmware/arm_scmi/mailbox.c\",\"drivers/firmware/arm_scmi/shmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.149\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.76\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.15\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.3\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-06T17:50:57.700750Z\",\"id\":\"CVE-2023-52608\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.7\",\"versionEndExcluding\":\"5.15.149\",\"matchCriteriaId\":\"56161013-9B71-44D2-9D99-A4941EC08570\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.76\",\"matchCriteriaId\":\"32F0FEB3-5FE1-4400-A56D-886F09BE872E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.15\",\"matchCriteriaId\":\"87C718CB-AE3D-4B07-B4D9-BFF64183C468\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.3\",\"matchCriteriaId\":\"58FD5308-148A-40D3-B36A-0CA6B434A8BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12dc4217f16551d6dee9cbefc23fdb5659558cda\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/437a310b22244d4e0b78665c3042e5d1c0f45306\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/614cc65032dcb0b64d23f5c5e338a8a04b12be5d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7f95f6997f4fdd17abec3200cae45420a5489350\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/12dc4217f16551d6dee9cbefc23fdb5659558cda\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/437a310b22244d4e0b78665c3042e5d1c0f45306\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/614cc65032dcb0b64d23f5c5e338a8a04b12be5d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7f95f6997f4fdd17abec3200cae45420a5489350\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T13:49:35+00:00",
      "cve": "CVE-2023-52608",
      "id": "CVE-2023-52608",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: firmware: arm_scmi: Check mailbox/SMT channel for consistency",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52608.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/614cc65032dcb0b64d23f5c5e338a8a04b12be5d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7f95f6997f4fdd17abec3200cae45420a5489350\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/12dc4217f16551d6dee9cbefc23fdb5659558cda\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/437a310b22244d4e0b78665c3042e5d1c0f45306\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:03:21.210Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52608\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-06T17:50:57.700750Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-06T17:51:05.894Z\"}}], \"cna\": {\"title\": \"firmware: arm_scmi: Check mailbox/SMT channel for consistency\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\", \"lessThan\": \"614cc65032dcb0b64d23f5c5e338a8a04b12be5d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\", \"lessThan\": \"7f95f6997f4fdd17abec3200cae45420a5489350\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\", \"lessThan\": \"9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\", \"lessThan\": \"12dc4217f16551d6dee9cbefc23fdb5659558cda\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\", \"lessThan\": \"437a310b22244d4e0b78665c3042e5d1c0f45306\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/firmware/arm_scmi/common.h\", \"drivers/firmware/arm_scmi/mailbox.c\", \"drivers/firmware/arm_scmi/shmem.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.149\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.76\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.15\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/firmware/arm_scmi/common.h\", \"drivers/firmware/arm_scmi/mailbox.c\", \"drivers/firmware/arm_scmi/shmem.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/614cc65032dcb0b64d23f5c5e338a8a04b12be5d\"}, {\"url\": \"https://git.kernel.org/stable/c/7f95f6997f4fdd17abec3200cae45420a5489350\"}, {\"url\": \"https://git.kernel.org/stable/c/9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2\"}, {\"url\": \"https://git.kernel.org/stable/c/12dc4217f16551d6dee9cbefc23fdb5659558cda\"}, {\"url\": \"https://git.kernel.org/stable/c/437a310b22244d4e0b78665c3042e5d1c0f45306\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: arm_scmi: Check mailbox/SMT channel for consistency\\n\\nOn reception of a completion interrupt the shared memory area is accessed\\nto retrieve the message header at first and then, if the message sequence\\nnumber identifies a transaction which is still pending, the related\\npayload is fetched too.\\n\\nWhen an SCMI command times out the channel ownership remains with the\\nplatform until eventually a late reply is received and, as a consequence,\\nany further transmission attempt remains pending, waiting for the channel\\nto be relinquished by the platform.\\n\\nOnce that late reply is received the channel ownership is given back\\nto the agent and any pending request is then allowed to proceed and\\noverwrite the SMT area of the just delivered late reply; then the wait\\nfor the reply to the new request starts.\\n\\nIt has been observed that the spurious IRQ related to the late reply can\\nbe wrongly associated with the freshly enqueued request: when that happens\\nthe SCMI stack in-flight lookup procedure is fooled by the fact that the\\nmessage header now present in the SMT area is related to the new pending\\ntransaction, even though the real reply has still to arrive.\\n\\nThis race-condition on the A2P channel can be detected by looking at the\\nchannel status bits: a genuine reply from the platform will have set the\\nchannel free bit before triggering the completion IRQ.\\n\\nAdd a consistency check to validate such condition in the A2P ISR.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.149\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.76\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.15\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.3\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:39:47.368Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52608\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:39:47.368Z\", \"dateReserved\": \"2024-03-02T21:55:42.574Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-13T14:01:48.870Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.