LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53487: powerpc/rtas_flash: allow user copy to flash block cache objects

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas_flash: allow user copy to flash block cache objects With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare a system firmware update yields a BUG(): kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2 Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860_146) hv:phyp pSeries NIP: c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000 REGS: c0000000148c76a0 TRAP: 0700 Not tainted (6.5.0-rc3+) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 24002242 XER: 0000000c CFAR: c0000000001fbd34 IRQMASK: 0 [ ... GPRs omitted ... ] NIP usercopy_abort+0xa0/0xb0 LR usercopy_abort+0x9c/0xb0 Call Trace: usercopy_abort+0x9c/0xb0 (unreliable) __check_heap_object+0x1b4/0x1d0 __check_object_size+0x2d0/0x380 rtas_flash_write+0xe4/0x250 proc_reg_write+0xfc/0x160 vfs_write+0xfc/0x4e0 ksys_write+0x90/0x160 system_call_exception+0x178/0x320 system_call_common+0x160/0x2c4 The blocks of the firmware image are copied directly from user memory to objects allocated from flash_block_cache, so flash_block_cache must be created using kmem_cache_create_usercopy() to mark it safe for user access. [mpe: Trim and indent oops]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel defect on PowerPC systems where preparing a firmware update through the RTAS firmware update interface can crash the kernel when hardened usercopy is enabled. The public record describes a kernel BUG, not data theft or remote compromise.

Executive priority

Treat this as a targeted infrastructure stability issue, not a broad internet-facing emergency. Patch during the next suitable maintenance window for affected PowerPC systems, sooner where shared local access or automated firmware workflows exist.

Technical view

The rtas_flash code copied firmware image blocks from user memory into flash_block_cache objects. With CONFIG_HARDENED_USERCOPY=y, those cache objects were not marked usercopy-safe, causing usercopy_abort and a kernel BUG. The fix creates the cache with kmem_cache_create_usercopy().

Likely exposure

Exposure appears limited to Linux PowerPC/pSeries environments using the /proc/powerpc/rtas/firmware_update path. General x86 Linux fleets are not indicated by the provided sources. Practical risk is highest where local users or maintenance automation can initiate firmware update preparation.

Exploitation context

The source bundle does not show KEV listing, public exploitation, or a CVSS score. The documented impact is a local kernel crash during firmware update preparation, based on the included oops trace and kernel fix description.

Researcher notes

Evidence supports a denial-of-service style kernel BUG tied to hardened usercopy enforcement. The bundle does not provide privilege requirements, CVSS, CWE, or proof of exploitation, so avoid broader impact claims without vendor-specific advisories.

Mitigation direction

  • Update affected Linux kernels to a release containing the referenced stable fixes.
  • Prioritize PowerPC or IBM pSeries systems that use RTAS firmware updates.
  • Check distribution vendor advisories for exact package versions and backports.
  • Restrict firmware update workflows to trusted administrators where operationally possible.

Validation and detection

  • Inventory Linux systems running on PowerPC or pSeries hardware.
  • Check whether CONFIG_HARDENED_USERCOPY is enabled on relevant kernels.
  • Review kernel package versions against vendor backport guidance.
  • Confirm the applied kernel includes the rtas_flash usercopy-safe cache fix.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53487 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6d07d1cd300f4c7e16005f881fea388164999cc8, 6d07d1cd300f4c7e16005f881fea388164999cc8, 6d07d1cd300f4c7e16005f881fea388164999cc8, 6d07d1cd300f4c7e16005f881fea388164999cc8, 6d07d1cd300f4c7e16005f881fea388164999cc8, 6d07d1cd300f4c7e16005f881fea388164999cc8, 6d07d1cd300f4c7e16005f881fea388164999cc8unaffected
LinuxLinux4.16, 0, 4.19.293, 5.4.255, 5.10.192, 5.15.128, 6.1.47, 6.4.12, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.