LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53376: scsi: mpi3mr: Use number of bits to manage bitmap sizes

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Use number of bits to manage bitmap sizes To allocate bitmaps, the mpi3mr driver calculates sizes of bitmaps using byte as unit. However, bitmap helper functions assume that bitmaps are allocated using unsigned long as unit. This gap causes memory access beyond the bitmap sizes and results in "BUG: KASAN: slab-out-of-bounds". The BUG was observed at firmware download to eHBA-9600. Call trace indicated that the out-of-bounds access happened in find_first_zero_bit() called from mpi3mr_send_event_ack() for miroc->evtack_cmds_bitmap. To fix the BUG, do not use bytes to manage bitmap sizes. Instead, use number of bits, and call bitmap helper functions which take number of bits as arguments. For memory allocation, call bitmap_zalloc() instead of kzalloc() and krealloc(). For memory free, call bitmap_free() instead of kfree(). For zero clear, call bitmap_clear() instead of memset(). Remove three fields for bitmap byte sizes in struct scmd_priv which are no longer required. Replace the field dev_handle_bitmap_sz with dev_handle_bitmap_bits to keep number of bits of removepend_bitmap across resize.

HighCVSS 7.1Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2023-53376 is a Linux kernel bug in the mpi3mr SCSI driver. A bitmap size mismatch can cause out-of-bounds kernel memory access during driver activity, observed during firmware download to eHBA-9600. Business urgency is highest for systems using this driver or related Broadcom/LSI MegaRAID-style HBAs. Public sources do not indicate active exploitation.

Executive priority

Treat as a targeted infrastructure patching issue, not an internet-wide emergency. Prioritize storage-heavy Linux servers using mpi3mr-supported HBAs because kernel memory corruption can affect service availability and data confidentiality. No active exploitation is documented in the provided sources.

Technical view

The mpi3mr driver allocated bitmap storage using byte-based sizing while Linux bitmap helpers operate on unsigned-long units and bit counts. This can trigger slab out-of-bounds access in find_first_zero_bit(), called from mpi3mr_send_event_ack() for evtack_cmds_bitmap. The fix changes bitmap management to bit counts and uses bitmap_zalloc(), bitmap_free(), and bitmap_clear().

Likely exposure

Exposure is likely limited to Linux systems with the mpi3mr SCSI driver in use, especially hosts using supported HBA hardware such as the eHBA-9600 scenario mentioned in the kernel description. The CVE record lists Linux kernel versions including 5.14, 6.1.18, 6.2.5, and 6.3 as affected.

Exploitation context

The CVSS vector is local, low complexity, low privileges, no user interaction, with high confidentiality and availability impact. The source bundle shows no CISA KEV listing and provides no public evidence of active exploitation. The observed failure was a KASAN slab out-of-bounds bug during firmware download activity.

Researcher notes

Evidence is based on the CVE record and Linux stable commits. The affected-version data in the bundle is sparse and commit-oriented, so distribution backports must be verified with vendor advisories. Avoid assuming exploitability beyond the stated local, low-privilege CVSS context.

Mitigation direction

  • Prioritize kernel updates from your Linux distribution or vendor.
  • Confirm the vendor kernel includes one of the referenced stable fixes.
  • Patch or replace affected kernels on systems using mpi3mr hardware.
  • If patching is delayed, review vendor guidance for supported risk reductions.

Validation and detection

  • Inventory Linux hosts with the mpi3mr driver loaded or packaged.
  • Identify kernel versions and compare against vendor fixed builds.
  • Check vendor advisories for backported fixes matching the referenced commits.
  • Review kernel logs for mpi3mr or KASAN out-of-bounds messages.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-125: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-53376 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2023-53376Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux824a156633dfdb0e17979a0d0bb2c757d1bb949c, 824a156633dfdb0e17979a0d0bb2c757d1bb949c, 824a156633dfdb0e17979a0d0bb2c757d1bb949cunaffected
LinuxLinux5.14, 0, 6.1.18, 6.2.5, 6.3affected
Weakness

CWE details

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-125 · source CWE mapping

Out-of-bounds Read

Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.