Security readout for executives and security teams
Plain-English summary
CVE-2023-53373 is a Linux kernel memory-safety flaw in the crypto seqiv component. A local user could potentially trigger a use-after-free, risking full confidentiality, integrity, and availability impact on the affected host. It is not listed as CISA KEV, and the provided sources do not show active exploitation.
Executive priority
Treat as high priority for Linux fleets where local users or workloads are not fully trusted. It is less urgent than a remotely exploitable KEV issue, but kernel privilege-impact bugs can become serious in shared infrastructure.
Technical view
The seqiv crypto code mishandled EBUSY for requests using MAY_BACKLOG. It freed request-related data when the request could still be backlogged, creating a CWE-416 use-after-free. The CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, no user interaction, and high CIA impact.
Likely exposure
Exposure is mainly Linux systems running affected kernel versions or downstream kernels that have not incorporated the referenced stable fixes. The attack vector is local, so risk is higher on multi-user systems, shared servers, container hosts, and environments allowing untrusted local workloads.
Exploitation context
The source bundle marks KEV as false and provides no cited evidence of exploitation in the wild. Exploitation requires local access with low privileges, but successful exploitation could have severe host impact due to kernel-level memory corruption.
Researcher notes
Public details identify the root cause and stable kernel commits, but the bundle does not include exploitability proof, affected distribution package mappings, or runtime prerequisites beyond seqiv/MAY_BACKLOG behavior. Use distro advisories for precise exposure decisions.
Mitigation direction
- Apply vendor Linux kernel updates that include the referenced seqiv EBUSY handling fix.
- Prioritize multi-user systems, container hosts, and servers running untrusted local code.
- If updates are delayed, reduce untrusted local access and workload co-tenancy.
- Track distribution advisories for backported fixes and exact package versions.
Validation and detection
- Inventory Linux kernel versions across servers, endpoints, appliances, and images.
- Compare installed kernels with vendor advisories and the CVE record.
- Confirm the relevant stable kernel fix is present or backported.
- Validate golden images and container hosts are rebuilt with patched kernels.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-53373 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cc4d0d4251748a8a68026938f4055d2ac47c5719CVE reference, Linux
- https://git.kernel.org/stable/c/1effbddaff60eeef8017c6dea1ee0ed970164d14CVE reference, Linux
- https://git.kernel.org/stable/c/63551e4b7cbcd9914258827699eb2cb6ed6e4a16CVE reference, Linux
- https://git.kernel.org/stable/c/ae849d2f48019ff9c104e32bf588ccbfb200e971CVE reference, Linux
- https://git.kernel.org/stable/c/36ec108b7bd7e280edb22de028467bd09d644620CVE reference, Linux
- https://git.kernel.org/stable/c/4d497e8b200a175094e0ac252ed878add39b8771CVE reference, Linux
- https://git.kernel.org/stable/c/9477db935eb690f697d9bcc4f608927841bc8b36CVE reference, Linux
- https://git.kernel.org/stable/c/32e62025e5e52fbe4812ef044759de7010b15dbcCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.