Vulnerability-Lookup

FKIE_CVE-2023-53039

Vulnerability from fkie_nvd - Published: 2025-05-02 16:15 - Updated: 2026-08-04 10:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function When a reset notify IPC message is received, the ISR schedules a work function and passes the ISHTP device to it via a global pointer ishtp_dev. If ish_probe() fails, the devm-managed device resources including ishtp_dev are freed, but the work is not cancelled, causing a use-after-free when the work function tries to access ishtp_dev. Use devm_work_autocancel() instead, so that the work is automatically cancelled if probe fails.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0a594cb490ca6232671fc09e2dc1a0fc7ccbb0b5	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8c1d378b8c224fd50247625255f09fc01dcc5836	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d3ce3afd9f791dd1b7daedfcf8c396b60af5dec0	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.3

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-ish-hid/ipc/ipc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c1d378b8c224fd50247625255f09fc01dcc5836",
              "status": "affected",
              "version": "ae02e5d40d5f829c589412c6253f925e35cf7a22",
              "versionType": "git"
            },
            {
              "lessThan": "0a594cb490ca6232671fc09e2dc1a0fc7ccbb0b5",
              "status": "affected",
              "version": "ae02e5d40d5f829c589412c6253f925e35cf7a22",
              "versionType": "git"
            },
            {
              "lessThan": "d3ce3afd9f791dd1b7daedfcf8c396b60af5dec0",
              "status": "affected",
              "version": "ae02e5d40d5f829c589412c6253f925e35cf7a22",
              "versionType": "git"
            },
            {
              "lessThan": "8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785",
              "status": "affected",
              "version": "ae02e5d40d5f829c589412c6253f925e35cf7a22",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-ish-hid/ipc/ipc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "56B5A662-596A-4D8B-B5EF-CFD78766E63E",
              "versionEndExcluding": "5.15.105",
              "versionStartIncluding": "4.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "642B6F99-95C6-47F5-A9B1-5C45FE08CAD0",
              "versionEndExcluding": "6.1.22",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "914F22DD-1E6F-4B0A-A14D-3A9F068F6761",
              "versionEndExcluding": "6.2.9",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B8E3B0E8-FA27-4305-87BB-AF6C25B160CB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-ish-hid: ipc: Fix potential use-after-free in work function\n\nWhen a reset notify IPC message is received, the ISR schedules a work\nfunction and passes the ISHTP device to it via a global pointer\nishtp_dev. If ish_probe() fails, the devm-managed device resources\nincluding ishtp_dev are freed, but the work is not cancelled, causing a\nuse-after-free when the work function tries to access ishtp_dev. Use\ndevm_work_autocancel() instead, so that the work is automatically\ncancelled if probe fails."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HID: intel-ish-hid: ipc: Se corrige un posible fallo de use after free en la funci\u00f3n de trabajo. Cuando se recibe un mensaje de notificaci\u00f3n de reinicio de IPC, el ISR programa una funci\u00f3n de trabajo y le transfiere el dispositivo ISHTP mediante un puntero global ishtp_dev. Si ish_probe() falla, se liberan los recursos del dispositivo administrados por devm, incluyendo ishtp_dev, pero el trabajo no se cancela, lo que provoca un fallo de use after free cuando la funci\u00f3n de trabajo intenta acceder a ishtp_dev. En su lugar, utilice devm_work_autocancel() para que el trabajo se cancele autom\u00e1ticamente si falla la sonda."
    }
  ],
  "id": "CVE-2023-53039",
  "lastModified": "2026-08-04T10:18:52.873",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-05-02T16:15:23.017",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/0a594cb490ca6232671fc09e2dc1a0fc7ccbb0b5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/8c1d378b8c224fd50247625255f09fc01dcc5836"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/d3ce3afd9f791dd1b7daedfcf8c396b60af5dec0"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2023-53039 (GCVE-0-2023-53039)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:54 – Updated: 2026-08-05 09:12

Title

HID: intel-ish-hid: ipc: Fix potential use-after-free in work function

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/8c1d378b8c224fd50…
https://git.kernel.org/stable/c/0a594cb490ca62326…
https://git.kernel.org/stable/c/d3ce3afd9f791dd1b…
https://git.kernel.org/stable/c/8ae2f2b0a28416ed2…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ae02e5d40d5f829c589412c6253f925e35cf7a22 , < 8c1d378b8c224fd50247625255f09fc01dcc5836 (git) Affected: ae02e5d40d5f829c589412c6253f925e35cf7a22 , < 0a594cb490ca6232671fc09e2dc1a0fc7ccbb0b5 (git) Affected: ae02e5d40d5f829c589412c6253f925e35cf7a22 , < d3ce3afd9f791dd1b7daedfcf8c396b60af5dec0 (git) Affected: ae02e5d40d5f829c589412c6253f925e35cf7a22 , < 8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785 (git)
Linux	Linux	Affected: 4.9 Unaffected: 0 , < 4.9 (semver) Unaffected: 5.15.105 , ≤ 5.15.* (semver) Unaffected: 6.1.22 , ≤ 6.1.* (semver) Unaffected: 6.2.9 , ≤ 6.2.* (semver) Unaffected: 6.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-ish-hid/ipc/ipc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c1d378b8c224fd50247625255f09fc01dcc5836",
              "status": "affected",
              "version": "ae02e5d40d5f829c589412c6253f925e35cf7a22",
              "versionType": "git"
            },
            {
              "lessThan": "0a594cb490ca6232671fc09e2dc1a0fc7ccbb0b5",
              "status": "affected",
              "version": "ae02e5d40d5f829c589412c6253f925e35cf7a22",
              "versionType": "git"
            },
            {
              "lessThan": "d3ce3afd9f791dd1b7daedfcf8c396b60af5dec0",
              "status": "affected",
              "version": "ae02e5d40d5f829c589412c6253f925e35cf7a22",
              "versionType": "git"
            },
            {
              "lessThan": "8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785",
              "status": "affected",
              "version": "ae02e5d40d5f829c589412c6253f925e35cf7a22",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-ish-hid/ipc/ipc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.105",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.22",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.9",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-ish-hid: ipc: Fix potential use-after-free in work function\n\nWhen a reset notify IPC message is received, the ISR schedules a work\nfunction and passes the ISHTP device to it via a global pointer\nishtp_dev. If ish_probe() fails, the devm-managed device resources\nincluding ishtp_dev are freed, but the work is not cancelled, causing a\nuse-after-free when the work function tries to access ishtp_dev. Use\ndevm_work_autocancel() instead, so that the work is automatically\ncancelled if probe fails."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the Intel ISH IPC PCI driver; MNG_RESET_NOTIFY is delivered via the on-chip sensor-hub interrupt path, not network or a pluggable bus. Reachability requires local access on a system with ISH, matching other intel-ish-hid scores (AV:L, not AV:P).\nAC:L - This is a use-after-free from scheduling fw_reset_work without cancelling it on probe failure/teardown; UAF bugs are AC:L unless the attacker cannot influence the race. Driver bind/teardown and FW reset notify give a practical way to drive both sides of the lifecycle race.\nPR:L - No capability-gated syscall is required to be on the system when ISH probe fails or FW reset work runs against freed state; related ISH reset and probe-error work bugs are scored PR:L. Deliberate sysfs unbind would be PR:H, so PR:L is chosen as the higher-severity defensible option.\nUI:N - Exploitation does not require a victim to perform an action such as opening a file or clicking; the work is scheduled from the ISH ISR/firmware reset path during driver probe/teardown.\nS:U - Impact is confined to the host kernel\u0027s security authority (memory corruption/privilege escalation in kernel context), with no VM, IOMMU, or other security-boundary crossing.\nC:H - Use-after-free of ishtp_device via the global ishtp_dev pointer in fw_reset_work_fn enables reclaim and controlled reuse of the object, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same UAF on a rich ishtp_device object (lists, callbacks, HW ops) enables heap reuse for arbitrary write and control-flow hijacking in kernel context.\nA:H - Dereferencing freed ishtp_dev in the reset work path causes kernel oops/panic even without full exploitation, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:29.445Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c1d378b8c224fd50247625255f09fc01dcc5836"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a594cb490ca6232671fc09e2dc1a0fc7ccbb0b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3ce3afd9f791dd1b7daedfcf8c396b60af5dec0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785"
        }
      ],
      "title": "HID: intel-ish-hid: ipc: Fix potential use-after-free in work function",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53039",
    "datePublished": "2025-05-02T15:54:57.876Z",
    "dateReserved": "2025-04-16T07:18:43.827Z",
    "dateUpdated": "2026-08-05T09:12:29.445Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2023-53039

CVE-2023-53039 (GCVE-0-2023-53039)

Tags

Sightings

Nomenclature

Related by attack behaviour