LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53550: cpufreq: amd-pstate: fix global sysfs attribute type

In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: fix global sysfs attribute type In commit 3666062b87ec ("cpufreq: amd-pstate: move to use bus_get_dev_root()") the "amd_pstate" attributes where moved from a dedicated kobject to the cpu root kobject. While the dedicated kobject expects to contain kobj_attributes the root kobject needs device_attributes. As the changed arguments are not used by the callbacks it works most of the time. However CFI will detect this issue: [ 4947.849350] CFI failure at dev_attr_show+0x24/0x60 (target: show_status+0x0/0x70; expected type: 0x8651b1de) ... [ 4947.849409] Call Trace: [ 4947.849410] <TASK> [ 4947.849411] ? __warn+0xcf/0x1c0 [ 4947.849414] ? dev_attr_show+0x24/0x60 [ 4947.849415] ? report_cfi_failure+0x4e/0x60 [ 4947.849417] ? handle_cfi_failure+0x14c/0x1d0 [ 4947.849419] ? __cfi_show_status+0x10/0x10 [ 4947.849420] ? handle_bug+0x4f/0x90 [ 4947.849421] ? exc_invalid_op+0x1a/0x60 [ 4947.849422] ? asm_exc_invalid_op+0x1a/0x20 [ 4947.849424] ? __cfi_show_status+0x10/0x10 [ 4947.849425] ? dev_attr_show+0x24/0x60 [ 4947.849426] sysfs_kf_seq_show+0xa6/0x110 [ 4947.849433] seq_read_iter+0x16c/0x4b0 [ 4947.849436] vfs_read+0x272/0x2d0 [ 4947.849438] ksys_read+0x72/0xe0 [ 4947.849439] do_syscall_64+0x76/0xb0 [ 4947.849440] ? do_user_addr_fault+0x252/0x650 [ 4947.849442] ? exc_page_fault+0x7a/0x1b0 [ 4947.849443] entry_SYSCALL_64_after_hwframe+0x72/0xdc

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel reliability bug in the AMD pstate CPU frequency driver. A sysfs attribute was registered with the wrong attribute type, which can trigger a Control Flow Integrity failure. The provided sources do not show remote exploitation, privilege escalation, CVSS scoring, or active exploitation.

Executive priority

Treat as a targeted kernel maintenance item unless vendor advisories rate it higher. No source here supports emergency response, but affected AMD Linux hosts should be updated through normal kernel patch governance.

Technical view

A prior amd-pstate change moved attributes from a dedicated kobject to the CPU root kobject, but retained kobj_attribute usage where device_attribute was required. The callbacks usually worked because unused arguments masked the mismatch, but CFI can detect the incompatible target during sysfs reads through dev_attr_show.

Likely exposure

Exposure appears limited to Linux systems using affected kernels and the amd-pstate driver path. The bundle lists Linux 6.4, 6.4.11, and 6.5 data, but downstream distribution backports and exact shipped status require vendor confirmation.

Exploitation context

The source bundle shows a CFI failure call trace during sysfs read activity. It does not cite public exploitation, KEV inclusion, weaponized exploit availability, or a remote attack path.

Researcher notes

The key evidence is the type mismatch between kobj_attribute and device_attribute after moving amd_pstate attributes to the CPU root kobject. CFI detection is central to observed impact; severity remains unclear from supplied data.

Mitigation direction

  • Check Linux distribution advisories for CVE-2023-53550 status and fixed kernel packages.
  • Prioritize kernel updates that include the referenced stable amd-pstate fixes.
  • Confirm AMD pstate usage before assigning broad fleet urgency.
  • Track vendor backports rather than relying only on upstream version numbers.

Validation and detection

  • Inventory Linux kernel versions and distribution package revisions across AMD systems.
  • Check whether the amd-pstate driver is enabled or in use.
  • Review kernel logs for CFI failures involving amd-pstate sysfs attributes.
  • Verify installed kernels include the referenced upstream stable commits.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53550 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3666062b87ec8be4b85dc475dfb54bb17e10a7f6, 3666062b87ec8be4b85dc475dfb54bb17e10a7f6unaffected
LinuxLinux6.4, 0, 6.4.11, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.