GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53572 (GCVE-0-2023-53572)

Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2026-08-05 09:14
VLAI
Title
clk: imx: scu: use _safe list iterator to avoid a use after free
Summary
In the Linux kernel, the following vulnerability has been resolved: clk: imx: scu: use _safe list iterator to avoid a use after free This loop is freeing "clk" so it needs to use list_for_each_entry_safe(). Otherwise it dereferences a freed variable to get the next item on the loop.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < f95ff838ac39f861d1f95a0f3bbb1e01c2517d79 (git)
Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba (git)
Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 3d90921f91fc6a8c801d527bb5848c99e335c1cf (git)
Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 0a719f0e4b6f233979e219baff73923e76a96e09 (git)
Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 632c60ecd25dbacee54d5581fe3aeb834b57010a (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.121 , ≤ 5.15.* (semver)
Unaffected: 6.1.39 , ≤ 6.1.* (semver)
Unaffected: 6.3.13 , ≤ 6.3.* (semver)
Unaffected: 6.4.4 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/imx/clk-scu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f95ff838ac39f861d1f95a0f3bbb1e01c2517d79",
              "status": "affected",
              "version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
              "versionType": "git"
            },
            {
              "lessThan": "08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba",
              "status": "affected",
              "version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
              "versionType": "git"
            },
            {
              "lessThan": "3d90921f91fc6a8c801d527bb5848c99e335c1cf",
              "status": "affected",
              "version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
              "versionType": "git"
            },
            {
              "lessThan": "0a719f0e4b6f233979e219baff73923e76a96e09",
              "status": "affected",
              "version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
              "versionType": "git"
            },
            {
              "lessThan": "632c60ecd25dbacee54d5581fe3aeb834b57010a",
              "status": "affected",
              "version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/imx/clk-scu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.121",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.39",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.13",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.4",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: scu: use _safe list iterator to avoid a use after free\n\nThis loop is freeing \"clk\" so it needs to use list_for_each_entry_safe().\nOtherwise it dereferences a freed variable to get the next item on the\nloop."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is in the i.MX8QXP/QM/DXL SCU platform clock-provider probe path (`imx8qxp_clk_probe()` \u2192 `imx_clk_scu_unregister()`), entered only through the local OF/device-driver model; no network, adjacent-network, or remote-peer data reaches a clock registration routine, and even the hypothetical re-entry routes (module load, DT overlay) require local system access.\nAC:H - The error branch is only taken when `of_clk_add_hw_provider()` fails, which after ruling out `of_clk_set_defaults()` (no in-tree i.MX8 SCU DT node carries `assigned-clocks`/`assigned-clock-rates`) reduces to a ~40-byte GFP_KERNEL `kzalloc()` failing during boot-time probe \u2014 small GFP_KERNEL allocations retry and OOM-kill rather than fail, and an attacker cannot induce memory pressure inside the boot-time probe window, so the precondition is genuinely outside attacker control.\nPR:L - There is no capability check anywhere along the path itself and the memory-pressure condition that would provoke the allocation failure needs no privilege at all; although the only explicit re-probe triggers (module load, DTB/overlay) are root-gated and `suppress_bind_attrs = true` removes the sysfs bind route, the uncertainty is resolved toward the lower privilege bar rather than PR:H.\nUI:N - The use-after-free fires automatically inside the driver\u0027s own probe error unwind; no administrator or victim must mount a filesystem, open a device, or take any other action for the freed-list walk to execute.\nS:U - The freed slab object, the wild pointer dereference, and the resulting corruption are all confined to kernel heap and the clk framework\u0027s own bookkeeping within a single security authority; no VM, container, IOMMU, or sandbox boundary is crossed.\nC:H - This is a genuine use-after-free read: `clk-\u003enode.next` is read from a kmalloc-64 object already returned to the allocator with no lock held, so a concurrently reallocated occupant\u0027s contents are consumed as a list pointer and its `clk-\u003ehw` field is dereferenced by `clk_unregister()`, which additionally prints `clk-\u003ecore-\u003ename` from that wild pointer to dmesg via `pr_err`/`pr_warn` \u2014 per kernel UAF treatment this warrants High.\nI:H - Once the loop follows a stale or reallocated `next` pointer, `clk_hw_unregister()` \u2192 `clk_unregister()` performs out-of-lifetime writes through it (`clk-\u003ecore-\u003eops = \u0026clk_nodrv_ops`, `hlist_del_init()`, `kref_put()`), and the loop body then `kfree()`s that attacker-influenceable address \u2014 an arbitrary-free plus wild-write primitive suitable for control-flow-relevant heap corruption.\nA:H - With `init_on_free` the freed `node.next` reads back as NULL and with SLUB poisoning as 0x6b6b..., either way oopsing immediately, and a reallocated object yields wild-pointer dereferences and freelist corruption during boot \u2014 on the embedded/automotive i.MX8QXP/QM boards this driver targets, commonly booted with panic_on_oops, that leaves the board unbootable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:54.320Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f95ff838ac39f861d1f95a0f3bbb1e01c2517d79"
        },
        {
          "url": "https://git.kernel.org/stable/c/08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d90921f91fc6a8c801d527bb5848c99e335c1cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a719f0e4b6f233979e219baff73923e76a96e09"
        },
        {
          "url": "https://git.kernel.org/stable/c/632c60ecd25dbacee54d5581fe3aeb834b57010a"
        }
      ],
      "title": "clk: imx: scu: use _safe list iterator to avoid a use after free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53572",
    "datePublished": "2025-10-04T15:17:13.089Z",
    "dateReserved": "2025-10-04T15:14:15.925Z",
    "dateUpdated": "2026-08-05T09:14:54.320Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53572",
      "date": "2026-09-16",
      "epss": "0.00141",
      "percentile": "0.03835"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53572\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-04T16:15:52.803\",\"lastModified\":\"2026-08-04T10:19:12.867\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclk: imx: scu: use _safe list iterator to avoid a use after free\\n\\nThis loop is freeing \\\"clk\\\" so it needs to use list_for_each_entry_safe().\\nOtherwise it dereferences a freed variable to get the next item on the\\nloop.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/clk/imx/clk-scu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4\",\"lessThan\":\"f95ff838ac39f861d1f95a0f3bbb1e01c2517d79\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4\",\"lessThan\":\"08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4\",\"lessThan\":\"3d90921f91fc6a8c801d527bb5848c99e335c1cf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4\",\"lessThan\":\"0a719f0e4b6f233979e219baff73923e76a96e09\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4\",\"lessThan\":\"632c60ecd25dbacee54d5581fe3aeb834b57010a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/clk/imx/clk-scu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.121\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.39\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.13\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.4\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.121\",\"matchCriteriaId\":\"EC77775B-EC31-4966-966C-1286C02B2A85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.39\",\"matchCriteriaId\":\"9BD1D4A1-304D-4187-8178-6D7C0050B1AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.3.13\",\"matchCriteriaId\":\"95CB4836-7F5D-4C20-B025-8E046EC87B78\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.4.4\",\"matchCriteriaId\":\"6AB81046-CB69-4115-924C-963B37C41385\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0a719f0e4b6f233979e219baff73923e76a96e09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3d90921f91fc6a8c801d527bb5848c99e335c1cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/632c60ecd25dbacee54d5581fe3aeb834b57010a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f95ff838ac39f861d1f95a0f3bbb1e01c2517d79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:16:51+00:00",
      "cve": "CVE-2023-53572",
      "id": "CVE-2023-53572",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "174",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: clk: imx: scu: use _safe list iterator to avoid a use after free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53572.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.