CVE-2023-53078
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak:
Fix the problem by freeing 'qdata' in error path.
Detalles técnicos trazas, registros y código del informe original
unreferenced object 0xffff88810b2c6980 (size 32):
comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$.............
backtrace:
[<0000000098f3a26d>] alua_activate+0xb0/0x320
[<000000003b529641>] scsi_dh_activate+0xb2/0x140
[<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath]
[<000000007adc9ace>] process_one_work+0x3c5/0x730
[<00000000c457a985>] worker_thread+0x93/0x650
[<00000000cb80e628>] kthread+0x1ba/0x210
[<00000000a1e61077>] ret_from_fork+0x22/0x30CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.20%
- Percentil entre todas las CVEs puntuadas: 9
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-401
Referencias
- https://git.kernel.org/stable/c/0d89254a4320eb7de0970c478172f764125c6355
- https://git.kernel.org/stable/c/123483df146492ca22b503ae6dacc2ce7c3a3974
- https://git.kernel.org/stable/c/1c55982beb80c7d3c30278fc6cfda8496a31dbe6
- https://git.kernel.org/stable/c/5c4d71424df34fc23dc5336d09394ce68c849542
- https://git.kernel.org/stable/c/9311e7a554dffd3823499e309a8b86a5cd1540e5
- https://git.kernel.org/stable/c/a13faca032acbf2699293587085293bdfaafc8ae
- https://git.kernel.org/stable/c/c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8
- https://git.kernel.org/stable/c/c110051d335ef7f62ad33474b0c23997fee5bfb5
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-53078",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "625fe857e4fac6518716f3c0ff5e5deb8ec6d238",
"lessThan": "123483df146492ca22b503ae6dacc2ce7c3a3974",
"versionType": "git"
},
{
"status": "affected",
"version": "625fe857e4fac6518716f3c0ff5e5deb8ec6d238",
"lessThan": "c110051d335ef7f62ad33474b0c23997fee5bfb5",
"versionType": "git"
},
{
"status": "affected",
"version": "625fe857e4fac6518716f3c0ff5e5deb8ec6d238",
"lessThan": "5c4d71424df34fc23dc5336d09394ce68c849542",
"versionType": "git"
},
{
"status": "affected",
"version": "625fe857e4fac6518716f3c0ff5e5deb8ec6d238",
"lessThan": "c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8",
"versionType": "git"
},
{
"status": "affected",
"version": "625fe857e4fac6518716f3c0ff5e5deb8ec6d238",
"lessThan": "9311e7a554dffd3823499e309a8b86a5cd1540e5",
"versionType": "git"
},
{
"status": "affected",
"version": "625fe857e4fac6518716f3c0ff5e5deb8ec6d238",
"lessThan": "1c55982beb80c7d3c30278fc6cfda8496a31dbe6",
"versionType": "git"
},
{
"status": "affected",
"version": "625fe857e4fac6518716f3c0ff5e5deb8ec6d238",
"lessThan": "0d89254a4320eb7de0970c478172f764125c6355",
"versionType": "git"
},
{
"status": "affected",
"version": "625fe857e4fac6518716f3c0ff5e5deb8ec6d238",
"lessThan": "a13faca032acbf2699293587085293bdfaafc8ae",
"versionType": "git"
},
{
"status": "affected",
"version": "68b275b7cbf065a8ea9b964cbb7d78d2b63c635f",
"versionType": "git"
},
{
"status": "affected",
"version": "2b1725d1df362499f6bbd5a7e245a4090b29c2bb",
"versionType": "git"
},
{
"status": "affected",
"version": "4.9.21",
"lessThan": "4.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.10.9",
"lessThan": "4.11",
"versionType": "semver"
}
],
"programFiles": [
"drivers/scsi/device_handler/scsi_dh_alua.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.11",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.14.312",
"versionType": "semver",
"lessThanOrEqual": "4.14.*"
},
{
"status": "unaffected",
"version": "4.19.280",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.240",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.177",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.105",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.22",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.2.9",
"versionType": "semver",
"lessThanOrEqual": "6.2.*"
},
{
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/scsi/device_handler/scsi_dh_alua.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-05-02T16:15:26.820",
"references": [
{
"url": "https://git.kernel.org/stable/c/0d89254a4320eb7de0970c478172f764125c6355",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/123483df146492ca22b503ae6dacc2ce7c3a3974",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1c55982beb80c7d3c30278fc6cfda8496a31dbe6",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5c4d71424df34fc23dc5336d09394ce68c849542",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9311e7a554dffd3823499e309a8b86a5cd1540e5",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a13faca032acbf2699293587085293bdfaafc8ae",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c110051d335ef7f62ad33474b0c23997fee5bfb5",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()\n\nIf alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not\nfreed, which will cause following memleak:\n\nunreferenced object 0xffff88810b2c6980 (size 32):\n comm \"kworker/u16:2\", pid 635322, jiffies 4355801099 (age 1216426.076s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$.............\n backtrace:\n [<0000000098f3a26d>] alua_activate+0xb0/0x320\n [<000000003b529641>] scsi_dh_activate+0xb2/0x140\n [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath]\n [<000000007adc9ace>] process_one_work+0x3c5/0x730\n [<00000000c457a985>] worker_thread+0x93/0x650\n [<00000000cb80e628>] kthread+0x1ba/0x210\n [<00000000a1e61077>] ret_from_fork+0x22/0x30\n\nFix the problem by freeing 'qdata' in error path."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: scsi_dh_alua: Se corrige la fuga de memoria para 'qdata' en alua_activate(). Si alua_rtpg_queue() falla desde alua_activate(), entonces 'qdata' no se libera, lo que causará la siguiente fuga de memoria: objeto sin referencia 0xffff88810b2c6980 (tamaño 32): comm \"kworker/u16:2\", pid 635322, jiffies 4355801099 (edad 1216426.076s) volcado hexadecimal (primeros 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. backtrace: [<0000000098f3a26d>] alua_activate+0xb0/0x320 [<000000003b529641>] scsi_dh_activate+0xb2/0x140 [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath] [<000000007adc9ace>] process_one_work+0x3c5/0x730 [<00000000c457a985>] worker_thread+0x93/0x650 [<00000000cb80e628>] kthread+0x1ba/0x210 [<00000000a1e61077>] ret_from_fork+0x22/0x30 Solucione el problema liberando 'qdata' en la ruta de error."
}
],
"lastModified": "2026-06-17T06:44:15.090",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "229871C9-E27A-4502-AFDC-7C777C21AC22",
"versionEndExcluding": "4.10",
"versionStartIncluding": "4.9.21"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A1D44092-A2CB-49EB-9E33-257AC7F9F3C4",
"versionEndExcluding": "4.11",
"versionStartIncluding": "4.10.9"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EBDB8DD9-108F-413D-A24A-A13F7A6855CF",
"versionEndExcluding": "4.14.312",
"versionStartIncluding": "4.11.1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8449DA5-0637-406C-99C3-84AF4CB5F3EB",
"versionEndExcluding": "4.19.280",
"versionStartIncluding": "4.15"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C5F51A3-AEBF-4E51-AA58-D8C8B4554A86",
"versionEndExcluding": "5.4.240",
"versionStartIncluding": "4.20"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9FED8369-E7A1-48C6-9700-6ADEDEC371F7",
"versionEndExcluding": "5.10.177",
"versionStartIncluding": "5.5"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0888AE70-CB0A-45C0-B9BD-A5371244C8DB",
"versionEndExcluding": "5.15.105",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "642B6F99-95C6-47F5-A9B1-5C45FE08CAD0",
"versionEndExcluding": "6.1.22",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "914F22DD-1E6F-4B0A-A14D-3A9F068F6761",
"versionEndExcluding": "6.2.9",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "623D643F-123E-4D3E-8CBF-16BF845D734B"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACE2C8C3-F2AA-4A39-9D81-B0F8BB82B834"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D67BFFD0-1A52-4F5D-98DB-D94B58FD8D30"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7D996F38-22AC-4059-84FC-F7D69CE0CB9B"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:4.11:rc8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97EFF4F7-E5F9-4FAA-AD58-94A24501AD59"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8E3B0E8-FA27-4305-87BB-AF6C25B160CB"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A47F0FC3-CE52-4BA1-BA51-22F783938431"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3583026A-27EC-4A4C-850A-83F2AF970673"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}