{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-53431 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2023-53431 is a high-severity vulnerability in Linux kernel, published on 18 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-53431 and fix it if it is affected.\n\nWhat it is: CVE-2023-53431 is a high-severity vulnerability in Linux kernel, published on 18 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-53431 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-53431/ (Markdown: https://insights.sbomify.com/CVE-2023-53431/index.md)","id":"CVE-2023-53431","markdown":"https://insights.sbomify.com/CVE-2023-53431/index.md","name":"CVE-2023-53431","record":{"aliases":["BELL-CVE-2023-53431","DEBIAN-CVE-2023-53431","GHSA-36rm-q238-p59m","UBUNTU-CVE-2023-53431"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel SCSI","requires_auth":"none","summary":"A null pointer dereference in the Linux kernel SCSI SES driver causes a crash when handling enclosures with only a primary component.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ses: Handle enclosure with just a primary component gracefully\n\nThis reverts commit 3fe97ff3d949 (\"scsi: ses: Don't attach if enclosure\nhas no components\") and introduces proper handling of case where there are\nno detected secondary components, but primary component (enumerated in\nnum_enclosures) does exist. That fix was originally proposed by Ding Hui\n\u003cdinghui@sangfor.com.cn\u003e.\n\nCompletely ignoring devices that have one primary enclosure and no\nsecondary one results in ses_intf_add() bailing completely\n\n\tscsi 2:0:0:254: enclosure has no enumerated components\n        scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such\n\neven on valid configurations with 1 primary and 0 secondary enclosures as\nbelow:\n\n\t# sg_ses /dev/sg0\n\t  3PARdata  SES               3321\n\tSupported diagnostic pages:\n\t  Supported Diagnostic Pages [sdp] [0x0]\n\t  Configuration (SES) [cf] [0x1]\n\t  Short Enclosure Status (SES) [ses] [0x8]\n\t# sg_ses -p cf /dev/sg0\n\t  3PARdata  SES               3321\n\tConfiguration diagnostic page:\n\t  number of secondary subenclosures: 0\n\t  generation code: 0x0\n\t  enclosure descriptor list\n\t    Subenclosure identifier: 0 [primary]\n\t      relative ES process id: 0, number of ES processes: 1\n\t      number of type descriptor headers: 1\n\t      enclosure logical identifier (hex): 20000002ac02068d\n\t      enclosure vendor: 3PARdata  product: VV                rev: 3321\n\t  type descriptor header and text list\n\t    Element type: Unspecified, subenclosure id: 0\n\t      number of possible elements: 1\n\nThe changelog for the original fix follows\n\n=====\nWe can get a crash when disconnecting the iSCSI session,\nthe call trace like this:\n\n  [ffff00002a00fb70] kfree at ffff00000830e224\n  [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4\n  [ffff00002a00fbd0] device_del at ffff0000086b6a98\n  [ffff00002a00fc50] device_unregister at ffff0000086b6d58\n  [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c\n  [ffff00002a00fca0] scsi_remove_device at ffff000008706134\n  [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4\n  [ffff00002a00fd10] scsi_remove_target at ffff0000087064c0\n  [ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4\n  [ffff00002a00fdb0] process_one_work at ffff00000810f35c\n  [ffff00002a00fe00] worker_thread at ffff00000810f648\n  [ffff00002a00fe70] kthread at ffff000008116e98\n\nIn ses_intf_add, components count could be 0, and kcalloc 0 size scomp,\nbut not saved in edev-\u003ecomponent[i].scratch\n\nIn this situation, edev-\u003ecomponent[0].scratch is an invalid pointer,\nwhen kfree it in ses_intf_remove_enclosure, a crash like above would happen\nThe call trace also could be other random cases when kfree cannot catch\nthe invalid pointer\n\nWe should not use edev-\u003ecomponent[] array when the components count is 0\nWe also need check index when use edev-\u003ecomponent[] array in\nses_enclosure_data_process\n=====","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"scsi: ses: Handle enclosure with just a primary component gracefully","id":"CVE-2023-53431","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2023"},"n_packages":0,"n_references":7,"next":{"headline":"firewire: net: fix use after free in fwnet_finish_incoming_packet()","id":"CVE-2023-53432"},"packages":[],"prev":{"headline":"wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup","id":"CVE-2023-53430"},"products":["Linux"],"published":"2025-09-18","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A null pointer dereference in the Linux kernel SCSI SES driver causes a crash when handling enclosures with only a primary component.","url":"https://insights.sbomify.com/CVE-2023-53431/"}