LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53242: thermal/drivers/hisi: Drop second sensor hi3660

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/hisi: Drop second sensor hi3660 The commit 74c8e6bffbe1 ("driver core: Add __alloc_size hint to devm allocators") exposes a panic "BRK handler: Fatal exception" on the hi3660_thermal_probe funciton. This is because the function allocates memory for only one sensors array entry, but tries to fill up a second one. Fix this by removing the unneeded second access.

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-53242 is a Linux kernel availability bug in the HiSilicon hi3660 thermal driver. The driver allocated space for one sensor entry but wrote a second one, causing a fatal kernel exception. Business impact is likely device outage, not data theft, and exposure appears limited to affected kernels using this driver.

Executive priority

Handle through normal kernel patch governance, with higher priority for embedded or appliance fleets using HiSilicon hi3660 hardware. There is no source-backed active exploitation signal, but the impact can be a full device outage where exposed.

Technical view

The issue is in thermal/drivers/hisi during hi3660_thermal_probe. A prior driver-core allocation-size hint exposed that the code allocated one sensors array entry but accessed a second. The resolved fix removes the unnecessary second access. CVSS 3.1 is 5.5: local, low complexity, low privileges, no user interaction, high availability impact.

Likely exposure

Exposure is most likely on Linux systems running affected kernel versions with the HiSilicon hi3660 thermal driver present and reachable. General-purpose servers without this hardware or driver path are less likely exposed. The source bundle lists Linux as affected, including versions around 4.20 through 6.3 and stable branch points.

Exploitation context

The source bundle does not show CISA KEV listing or other evidence of active exploitation. The CVSS vector requires local low privileges and affects availability only. Treat this as a kernel panic risk on relevant hardware rather than a remote compromise issue.

Researcher notes

Focus validation on code lineage and hardware reachability. The key condition is an out-of-bounds second sensor array access in hi3660_thermal_probe. The public record does not provide exploit details, affected distro package names, or a complete product matrix beyond Linux kernel references.

Mitigation direction

  • Update affected Linux kernels to versions containing the referenced stable fixes.
  • Check distribution or device-vendor advisories for packaged kernel fix availability.
  • Prioritize systems using HiSilicon hi3660 thermal hardware or kernels with this driver enabled.
  • Apply normal kernel reboot and rollback planning for availability-sensitive devices.

Validation and detection

  • Inventory kernel versions against the affected ranges in the CVE record.
  • Confirm whether the hisi hi3660 thermal driver is built or loaded.
  • Review vendor kernel changelogs for the referenced stable commit identifiers.
  • Monitor affected devices for kernel panic or fatal exception events.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53242 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2023-53242Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7d3a2a2bbadb4bf5856ed394ba09b8fbb7a80460, 7d3a2a2bbadb4bf5856ed394ba09b8fbb7a80460, 7d3a2a2bbadb4bf5856ed394ba09b8fbb7a80460, 7d3a2a2bbadb4bf5856ed394ba09b8fbb7a80460, 7d3a2a2bbadb4bf5856ed394ba09b8fbb7a80460, 7d3a2a2bbadb4bf5856ed394ba09b8fbb7a80460unaffected
LinuxLinux4.20, 0, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.