LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53578: net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() Syzbot reported a bug as following: ===================================================== BUG: KMSAN: uninit-value in qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230 qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230 qrtr_endpoint_post+0xf85/0x11b0 net/qrtr/af_qrtr.c:519 qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108 call_write_iter include/linux/fs.h:2189 [inline] aio_write+0x63a/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook mm/slab.h:766 [inline] slab_alloc_node mm/slub.c:3452 [inline] __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline] __kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988 kmalloc_reserve net/core/skbuff.c:492 [inline] __alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565 __netdev_alloc_skb+0x120/0x7d0 net/core/skbuff.c:630 qrtr_endpoint_post+0xbd/0x11b0 net/qrtr/af_qrtr.c:446 qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108 call_write_iter include/linux/fs.h:2189 [inline] aio_write+0x63a/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd It is because that skb->len requires at least sizeof(struct qrtr_ctrl_pkt) in qrtr_tx_resume(). And skb->len equals to size in qrtr_endpoint_post(). But size is less than sizeof(struct qrtr_ctrl_pkt) when qrtr_cb->type equals to QRTR_TYPE_RESUME_TX in qrtr_endpoint_post() under the syzbot scenario. This triggers the uninit variable access bug. Add size check when qrtr_cb->type equals to QRTR_TYPE_RESUME_TX in qrtr_endpoint_post() to fix the bug.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-53578 is a Linux kernel bug in the QRTR networking code. A malformed or undersized QRTR resume-transmit packet can trigger use of uninitialized memory. The public record describes a syzbot-discovered kernel bug and stable-kernel fixes, but does not provide CVSS, confirmed exploitation, or business impact details.

Executive priority

Treat this as a routine kernel maintenance item unless your environment depends on QRTR-enabled kernels or vendor guidance raises severity. There is no sourced evidence of active exploitation, but kernel memory-safety bugs should be remediated through standard patch cycles.

Technical view

The flaw is in qrtr_tx_resume() and qrtr_endpoint_post() in net/qrtr. When qrtr_cb->type is QRTR_TYPE_RESUME_TX, skb->len may be smaller than sizeof(struct qrtr_ctrl_pkt), leading to uninitialized-value access. The fix adds a size check for QRTR_TYPE_RESUME_TX handling in qrtr_endpoint_post().

Likely exposure

Exposure is limited to Linux systems running affected kernel versions with the QRTR subsystem reachable in their configuration. The CVE record lists affected Linux versions around 5.6, 5.10.178, 5.15.108, 6.1.25, 6.2.12, and 6.3, but distribution backports may vary.

Exploitation context

The report came from syzbot kernel fuzzing. The provided sources do not state active exploitation, public exploit availability, remote reachability, privilege requirements, or practical impact beyond uninitialized-value access. It is not listed as CISA KEV in the provided bundle.

Researcher notes

The public details are narrow: syzbot found an uninitialized-value access caused by insufficient skb length validation for QRTR_TYPE_RESUME_TX. No CVSS, CWE, exploit status, or detailed attacker model is provided. Validation should focus on code lineage, kernel configuration, and downstream backports.

Mitigation direction

  • Apply Linux stable kernel updates containing the referenced QRTR fix commits.
  • Use distribution vendor advisories to identify the corrected package for your kernel stream.
  • If immediate patching is unavailable, review vendor guidance for temporary mitigations.
  • Prioritize systems where QRTR functionality is enabled or required.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and embedded systems.
  • Check whether vendor kernel packages include one of the referenced stable fixes.
  • Confirm whether QRTR support is enabled or loaded on relevant systems.
  • Track remediation through normal kernel update and reboot verification processes.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53578 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5fdeb0d372ab33b4175043a2a4a1730239a217f1, 5fdeb0d372ab33b4175043a2a4a1730239a217f1, 5fdeb0d372ab33b4175043a2a4a1730239a217f1, 5fdeb0d372ab33b4175043a2a4a1730239a217f1, 5fdeb0d372ab33b4175043a2a4a1730239a217f1unaffected
LinuxLinux5.6, 0, 5.10.178, 5.15.108, 6.1.25, 6.2.12, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.