CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
In the Linux kernel, the following vulnerability has been resolved:
cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
The cacheinfo sets up the shared_cpu_map by checking whether the caches
with the same index are shared between CPUs. However, this will trigger
slab-out-of-bounds access if the CPUs do not have the same cache hierarchy.
Another problem is the mismatched shared_cpu_map when the shared cache does
not have the same index between CPUs.
CPU0 I D L3
index 0 1 2 x
^ ^ ^ ^
index 0 1 2 3
CPU1 I D L2 L3
This patch checks each cache is shared with all caches on other CPUs.
Security readout for executives and security teams
Plain-English summary
A flaw in Linux kernel cache metadata handling can let a low-privileged local user trigger out-of-bounds memory access. The business risk is highest on systems where untrusted users can run local code, because the CVSS data indicates possible high confidentiality and availability impact.
Executive priority
Treat as high priority for Linux systems with local user access. It is not described as remotely exploitable, but kernel memory and availability impact justify prompt patch planning.
Technical view
Linux cacheinfo built shared_cpu_map by comparing caches at the same index across CPUs. If CPUs have different cache hierarchies, that assumption can cause slab out-of-bounds access and incorrect shared cache maps. The referenced fix compares each cache against all caches on other CPUs.
Likely exposure
Exposure is limited to affected Linux kernel versions or commits where local low-privileged code execution is possible. Network-only attackers are not indicated by the provided CVSS vector.
Exploitation context
The source bundle marks KEV as false and provides no cited evidence of active exploitation. The vulnerability is local, low-complexity, requires low privileges, and requires no user interaction according to CVSS.
Researcher notes
Evidence is limited to the CVE record and Linux stable commit references. No exploit details, public exploitation, or distribution-specific fixed package versions are provided in the bundle.
Mitigation direction
Update affected Linux kernels through the appropriate distribution or kernel vendor channel.
Confirm the deployed kernel includes one of the referenced stable fixes.
Prioritize multi-user systems and systems running untrusted local workloads.
Check vendor guidance for supported fixed versions before changing production kernels.
Validation and detection
Inventory Linux kernel versions across servers, workstations, and appliances.
Compare deployed kernels with the affected versions and referenced stable commits.
Verify distribution advisories map CVE-2023-53254 to installed packages.
Confirm reboot completion after kernel updates where required.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE-125 · source CWE mapping
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.