CVE-2023-53572 (GCVE-0-2023-53572)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2026-08-05 09:14
VLAI
EPSS
VEX
Title
clk: imx: scu: use _safe list iterator to avoid a use after free
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: imx: scu: use _safe list iterator to avoid a use after free
This loop is freeing "clk" so it needs to use list_for_each_entry_safe().
Otherwise it dereferences a freed variable to get the next item on the
loop.
Severity
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < f95ff838ac39f861d1f95a0f3bbb1e01c2517d79
(git)
Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba (git) Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 3d90921f91fc6a8c801d527bb5848c99e335c1cf (git) Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 0a719f0e4b6f233979e219baff73923e76a96e09 (git) Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 632c60ecd25dbacee54d5581fe3aeb834b57010a (git) |
guessed | |
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.121 , ≤ 5.15.* (semver) Unaffected: 6.1.39 , ≤ 6.1.* (semver) Unaffected: 6.3.13 , ≤ 6.3.* (semver) Unaffected: 6.4.4 , ≤ 6.4.* (semver) Unaffected: 6.5 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/imx/clk-scu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f95ff838ac39f861d1f95a0f3bbb1e01c2517d79",
"status": "affected",
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
"versionType": "git"
},
{
"lessThan": "08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba",
"status": "affected",
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
"versionType": "git"
},
{
"lessThan": "3d90921f91fc6a8c801d527bb5848c99e335c1cf",
"status": "affected",
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
"versionType": "git"
},
{
"lessThan": "0a719f0e4b6f233979e219baff73923e76a96e09",
"status": "affected",
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
"versionType": "git"
},
{
"lessThan": "632c60ecd25dbacee54d5581fe3aeb834b57010a",
"status": "affected",
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/imx/clk-scu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.121",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.121",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.39",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.13",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.4",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: scu: use _safe list iterator to avoid a use after free\n\nThis loop is freeing \"clk\" so it needs to use list_for_each_entry_safe().\nOtherwise it dereferences a freed variable to get the next item on the\nloop."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The defect is in the i.MX8QXP/QM/DXL SCU platform clock-provider probe path (`imx8qxp_clk_probe()` \u2192 `imx_clk_scu_unregister()`), entered only through the local OF/device-driver model; no network, adjacent-network, or remote-peer data reaches a clock registration routine, and even the hypothetical re-entry routes (module load, DT overlay) require local system access.\nAC:H - The error branch is only taken when `of_clk_add_hw_provider()` fails, which after ruling out `of_clk_set_defaults()` (no in-tree i.MX8 SCU DT node carries `assigned-clocks`/`assigned-clock-rates`) reduces to a ~40-byte GFP_KERNEL `kzalloc()` failing during boot-time probe \u2014 small GFP_KERNEL allocations retry and OOM-kill rather than fail, and an attacker cannot induce memory pressure inside the boot-time probe window, so the precondition is genuinely outside attacker control.\nPR:L - There is no capability check anywhere along the path itself and the memory-pressure condition that would provoke the allocation failure needs no privilege at all; although the only explicit re-probe triggers (module load, DTB/overlay) are root-gated and `suppress_bind_attrs = true` removes the sysfs bind route, the uncertainty is resolved toward the lower privilege bar rather than PR:H.\nUI:N - The use-after-free fires automatically inside the driver\u0027s own probe error unwind; no administrator or victim must mount a filesystem, open a device, or take any other action for the freed-list walk to execute.\nS:U - The freed slab object, the wild pointer dereference, and the resulting corruption are all confined to kernel heap and the clk framework\u0027s own bookkeeping within a single security authority; no VM, container, IOMMU, or sandbox boundary is crossed.\nC:H - This is a genuine use-after-free read: `clk-\u003enode.next` is read from a kmalloc-64 object already returned to the allocator with no lock held, so a concurrently reallocated occupant\u0027s contents are consumed as a list pointer and its `clk-\u003ehw` field is dereferenced by `clk_unregister()`, which additionally prints `clk-\u003ecore-\u003ename` from that wild pointer to dmesg via `pr_err`/`pr_warn` \u2014 per kernel UAF treatment this warrants High.\nI:H - Once the loop follows a stale or reallocated `next` pointer, `clk_hw_unregister()` \u2192 `clk_unregister()` performs out-of-lifetime writes through it (`clk-\u003ecore-\u003eops = \u0026clk_nodrv_ops`, `hlist_del_init()`, `kref_put()`), and the loop body then `kfree()`s that attacker-influenceable address \u2014 an arbitrary-free plus wild-write primitive suitable for control-flow-relevant heap corruption.\nA:H - With `init_on_free` the freed `node.next` reads back as NULL and with SLUB poisoning as 0x6b6b..., either way oopsing immediately, and a reallocated object yields wild-pointer dereferences and freelist corruption during boot \u2014 on the embedded/automotive i.MX8QXP/QM boards this driver targets, commonly booted with panic_on_oops, that leaves the board unbootable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:14:54.320Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f95ff838ac39f861d1f95a0f3bbb1e01c2517d79"
},
{
"url": "https://git.kernel.org/stable/c/08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba"
},
{
"url": "https://git.kernel.org/stable/c/3d90921f91fc6a8c801d527bb5848c99e335c1cf"
},
{
"url": "https://git.kernel.org/stable/c/0a719f0e4b6f233979e219baff73923e76a96e09"
},
{
"url": "https://git.kernel.org/stable/c/632c60ecd25dbacee54d5581fe3aeb834b57010a"
}
],
"title": "clk: imx: scu: use _safe list iterator to avoid a use after free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53572",
"datePublished": "2025-10-04T15:17:13.089Z",
"dateReserved": "2025-10-04T15:14:15.925Z",
"dateUpdated": "2026-08-05T09:14:54.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-53572",
"date": "2026-09-14",
"epss": "0.00141",
"percentile": "0.03803"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-53572\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-04T16:15:52.803\",\"lastModified\":\"2026-08-04T10:19:12.867\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclk: imx: scu: use _safe list iterator to avoid a use after free\\n\\nThis loop is freeing \\\"clk\\\" so it needs to use list_for_each_entry_safe().\\nOtherwise it dereferences a freed variable to get the next item on the\\nloop.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/clk/imx/clk-scu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4\",\"lessThan\":\"f95ff838ac39f861d1f95a0f3bbb1e01c2517d79\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4\",\"lessThan\":\"08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4\",\"lessThan\":\"3d90921f91fc6a8c801d527bb5848c99e335c1cf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4\",\"lessThan\":\"0a719f0e4b6f233979e219baff73923e76a96e09\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4\",\"lessThan\":\"632c60ecd25dbacee54d5581fe3aeb834b57010a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/clk/imx/clk-scu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.121\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.39\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.13\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.4\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.121\",\"matchCriteriaId\":\"EC77775B-EC31-4966-966C-1286C02B2A85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.39\",\"matchCriteriaId\":\"9BD1D4A1-304D-4187-8178-6D7C0050B1AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.3.13\",\"matchCriteriaId\":\"95CB4836-7F5D-4C20-B025-8E046EC87B78\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.4.4\",\"matchCriteriaId\":\"6AB81046-CB69-4115-924C-963B37C41385\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0a719f0e4b6f233979e219baff73923e76a96e09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3d90921f91fc6a8c801d527bb5848c99e335c1cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/632c60ecd25dbacee54d5581fe3aeb834b57010a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f95ff838ac39f861d1f95a0f3bbb1e01c2517d79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T19:16:51+00:00",
"cve": "CVE-2023-53572",
"id": "CVE-2023-53572",
"initial_release_date": "2023-01-01T00:00:00+00:00",
"product_status:fixed": "280",
"product_status:known_affected": "22",
"product_status:known_not_affected": "174",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: clk: imx: scu: use _safe list iterator to avoid a use after free",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53572.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…