Security readout for executives and security teams
Plain-English summary
CVE-2023-53298 is a Linux kernel memory leak in NFC secure element I/O handling. A local low-privileged user could trigger failed paths that leak callback context memory, potentially reducing availability. The source bundle rates it medium with CVSS 5.5 and does not show active exploitation.
Executive priority
Treat as a normal-priority kernel availability issue unless NFC-enabled multi-user or kiosk-like systems are in scope. Patch through standard kernel maintenance, but do not defer indefinitely on systems where untrusted local users exist.
Technical view
In nfc_genl_se_io, cb_context for APDU exchange should be freed by se_io_cb, but some error paths do not arm bwi_timer, so the callback never frees it. Stable fixes explicitly free cb_context on those paths. Impact is availability only under the provided CVSS vector.
Likely exposure
Exposure is most relevant on Linux systems running affected kernel versions with NFC support and secure element I/O functionality enabled or reachable by local users. Distro backports may change version conclusions, so validate using vendor kernel advisories and applied patch status.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of exploitation in the wild. The CVSS vector requires local access, low privileges, and no user interaction; it indicates no confidentiality or integrity impact, but high availability impact.
Researcher notes
Evidence supports a CWE-401 memory leak in the NFC generic netlink secure element I/O path. The key uncertainty is practical reachability across distributions and device configurations. Avoid assuming broad internet exposure; the provided vector is local only.
Mitigation direction
- Update to a kernel build containing the referenced stable fixes.
- Check Linux distribution advisories for backported fixes matching your kernel package.
- Prioritize systems where local users can access NFC functionality.
- Disable or restrict unnecessary NFC functionality where vendor guidance supports it.
- Monitor vendor security notices for any changed exploitation or patch guidance.
Validation and detection
- Inventory Linux kernel versions across endpoints, servers, and embedded systems.
- Confirm whether NFC and secure element functionality is enabled or exposed locally.
- Map installed kernel packages to vendor advisories and stable fix commits.
- Review vulnerability scanner findings for CVE-2023-53298 against actual kernel patch level.
- Verify patched systems after reboot are running the fixed kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-53298 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5321da6d84b87a34eea441677d649c34bd854169CVE reference, Linux
- https://git.kernel.org/stable/c/af452e35b9e6a87cd49e54a7a3d60d934b194651CVE reference, Linux
- https://git.kernel.org/stable/c/271eed1736426103335c5aac50f15b0f4d236bc0CVE reference, Linux
- https://git.kernel.org/stable/c/8978315cb4bf8878c9c8ec05dafd8f7ff539860dCVE reference, Linux
- https://git.kernel.org/stable/c/c494365432dcdc549986f4d9af9eb6190cbdb153CVE reference, Linux
- https://git.kernel.org/stable/c/b2036a252381949d3b743a3de069324ae3028a57CVE reference, Linux
- https://git.kernel.org/stable/c/ba98db08895748c12e5ded52cd1598dce2c79e55CVE reference, Linux
- https://git.kernel.org/stable/c/25ff6f8a5a3b8dc48e8abda6f013e8cc4b14ffeaCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.