Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw can corrupt migration data when certain HiSilicon accelerator devices are moved between virtualized hosts using VFIO pre-copy migration. The destination device may malfunction or become unavailable. Exploitation requires local, low-privileged access; the supplied evidence does not indicate remote exploitation or data disclosure.
Executive priority
Prioritize environments using HiSilicon accelerator passthrough and live device migration. Remediate promptly where that combination exists because failed migrations can disrupt accelerated workloads and corrupt device state. Other Linux systems should first confirm whether the specialized driver and workflow are present, avoiding an unnecessarily broad emergency response.
Technical view
The hisi_acc_vfio_pci driver failed to adjust saving and resuming data pointers using the file-descriptor offset during optional PRE_COPY migration. Corrupted migration state can produce integrity and availability failures when the destination device starts, including SMMU events, accelerator response errors, and queue doorbell timeouts. CVSS 3.1 is 7.1: local access, low complexity, low privileges, high integrity and availability impact.
Likely exposure
Exposure appears limited to affected Linux kernels operating supported HiSilicon accelerator hardware through hisi_acc_vfio_pci and performing VFIO device migration with optional pre-copy behavior. Systems without this hardware, driver, or migration workflow are unlikely to encounter the described path. The supplied affected-version data is ambiguous, so confirm kernel status against vendor advisories and the cited stable fixes.
Exploitation context
The supplied CVSS vector describes a local, low-privileged attack requiring no user interaction. CISA KEV status is false, and the bundle provides no evidence of active exploitation or a public exploit. The documented outcome is migration-state corruption affecting integrity and availability, sometimes visible only when the destination device starts.
Researcher notes
The defect concerns offset-relative migration buffers, not a documented network attack surface. The source bundle names Linux 6.2, 6.6.14, 6.7.2, and 6.8 among affected entries, but its version representation is inconsistent and includes an unexplained “0.” Treat commit or distributor backport verification as authoritative. No CWE is supplied.
Mitigation direction
- Update to a vendor-supported kernel release containing the applicable cited stable fix.
- Check Linux distribution advisories for backport status before relying solely on version numbers.
- Avoid VFIO pre-copy migration for affected HiSilicon accelerators until remediation is confirmed.
- Restrict local access and authorization for device-migration operations.
Validation and detection
- Inventory kernels, HiSilicon accelerator hardware, hisi_acc_vfio_pci usage, and VFIO migration workflows.
- Compare deployed kernel source or vendor changelogs with the three cited stable fixes.
- Review destination-host logs for SMMU events, qm_axi_rresp errors, and queue doorbell timeouts.
- Test authorized device migration in a controlled environment after updating, confirming destination-device health.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-52453 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H1.85.2LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/45f80b2f230df10600e6fa1b83b28bf1c334185eCVE reference, Linux
- https://git.kernel.org/stable/c/6bda81e24a35a856f58e6a5786de579b07371603CVE reference, Linux
- https://git.kernel.org/stable/c/be12ad45e15b5ee0e2526a50266ba1d295d26a88CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.