LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53783: blk-iocost: fix divide by 0 error in calc_lcoefs()

In the Linux kernel, the following vulnerability has been resolved: blk-iocost: fix divide by 0 error in calc_lcoefs() echo max of u64 to cost.model can cause divide by 0 error. # echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model divide error: 0000 [#1] PREEMPT SMP RIP: 0010:calc_lcoefs+0x4c/0xc0 Call Trace: <TASK> ioc_refresh_params+0x2b3/0x4f0 ioc_cost_model_write+0x3cb/0x4c0 ? _copy_from_iter+0x6d/0x6c0 ? kernfs_fop_write_iter+0xfc/0x270 cgroup_file_write+0xa0/0x200 kernfs_fop_write_iter+0x17d/0x270 vfs_write+0x414/0x620 ksys_write+0x73/0x160 __x64_sys_write+0x1e/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd calc_lcoefs() uses the input value of cost.model in DIV_ROUND_UP_ULL, overflow would happen if bps plus IOC_PAGE_SIZE is greater than ULLONG_MAX, it can cause divide by 0 error. Fix the problem by setting basecost

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-53783 is a Linux kernel bug in the block I/O cost controller. A specially large value written to a cgroup I/O cost setting can trigger a divide-by-zero kernel fault. Based on the supplied sources, the likely business impact is local denial of service, not proven remote compromise.

Executive priority

Treat as a practical stability risk for shared Linux hosts, container platforms, or systems delegating cgroup control. Prioritize routine kernel patching and privilege review.

Technical view

The flaw is in blk-iocost calc_lcoefs(). A bps value from io.cost.model can overflow when combined with IOC_PAGE_SIZE, causing DIV_ROUND_UP_ULL behavior that leads to a divide error. The trace reaches ioc_cost_model_write through cgroup_file_write. Linux stable commits are referenced as fixes.

Likely exposure

Exposure is likely limited to Linux systems using cgroup block I/O cost controls where an attacker or tenant can write io.cost.model values.

Exploitation context

The source bundle provides a crashing input example and kernel trace, but no KEV listing and no cited active exploitation evidence.

Researcher notes

The bundle lists affected Linux versions and stable fix commits, but gives no CVSS, CWE, or exploit-in-the-wild evidence. Avoid assuming broader impact beyond local kernel fault conditions involving io.cost.model writes.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Check your Linux distribution advisory for the exact fixed package version.
  • Restrict write access to cgroup io.cost.model to trusted administrators only.
  • Audit container or tenant privileges that allow cgroup I/O controller modification.

Validation and detection

  • Inventory Linux hosts and kernel versions against distribution security advisories.
  • Confirm whether cgroup I/O cost controls are enabled or exposed.
  • Review permissions around /sys/fs/cgroup/io.cost.model.
  • Verify deployed kernels include the referenced stable fix commits.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53783 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7caa47151ab2e644dd221f741ec7578d9532c9a3, 7caa47151ab2e644dd221f741ec7578d9532c9a3, 7caa47151ab2e644dd221f741ec7578d9532c9a3, 7caa47151ab2e644dd221f741ec7578d9532c9a3, 7caa47151ab2e644dd221f741ec7578d9532c9a3, 7caa47151ab2e644dd221f741ec7578d9532c9a3unaffected
LinuxLinux5.4, 0, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.