LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53820: loop: loop_set_status_from_info() check before assignment

In the Linux kernel, the following vulnerability has been resolved: loop: loop_set_status_from_info() check before assignment In loop_set_status_from_info(), lo->lo_offset and lo->lo_sizelimit should be checked before reassignment, because if an overflow error occurs, the original correct value will be changed to the wrong value, and it will not be changed back. More, the original patch did not solve the problem, the value was set and ioctl returned an error, but the subsequent io used the value in the loop driver, which still caused an alarm: loop_handle_cmd do_req_filebacked loff_t pos = ((loff_t) blk_rq_pos(rq) << 9) + lo->lo_offset; lo_rw_aio cmd->iocb.ki_pos = pos

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel loop-device bug. When invalid loop device settings overflow, the kernel may return an error but still leave bad offset or size-limit values in place. Later I/O can use those wrong values. The sources do not provide CVSS, business impact, or confirmed exploitation.

Executive priority

Treat this as a kernel maintenance item unless vendor guidance elevates it. There is no sourced evidence of active exploitation, but affected systems using loop devices should receive normal security kernel updates after compatibility testing.

Technical view

The flaw is in loop_set_status_from_info(). lo_offset and lo_sizelimit were assigned before overflow validation. On overflow, the ioctl could fail while the loop device retained the incorrect reassigned values, and later loop_handle_cmd/do_req_filebacked I/O used lo->lo_offset in position calculation.

Likely exposure

Exposure is limited to Linux systems using loop devices, such as disk image, container, installer, or virtual block workflows. The source bundle lists Linux kernel versions and stable commits, but distro-specific package status must be verified separately.

Exploitation context

The provided sources do not show active exploitation, a public exploit, KEV listing, or a weaponized attack path. The described condition requires interaction with loop device configuration and subsequent I/O using the corrupted loop state.

Researcher notes

The record describes a state-consistency issue after failed validation, not a complete exploit chain. Key gaps are absent CVSS, unclear privilege requirements, and no sourced impact classification. Validate against exact upstream or distribution patch lineage before assigning operational severity.

Mitigation direction

  • Check vendor or distribution advisories for CVE-2023-53820 kernel packages.
  • Update to a kernel containing the referenced stable loop driver fix.
  • Restrict loop device administration to trusted users and automation.
  • Review workloads that create or modify loop-backed devices.
  • Track kernel updates across hosts, images, and appliances.

Validation and detection

  • Inventory Linux kernel versions on systems using loop devices.
  • Compare installed kernels against vendor fixed-package guidance.
  • Confirm whether loop device workflows exist in containers, installers, or image tooling.
  • Review change records for kernel updates containing the referenced stable commits.
  • Monitor kernel logs for loop driver warnings or I/O anomalies.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53820 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2035c770bfdbcc82bd52e05871a7c82db9529e0f, a217715338fd48f72114725aa7a40e484a781ca7, 13b2856037a651ba3ab4a8b25ecab3e791926da3, b40877b8562c5720d0a7fce20729f56b75a3dede, 6858933131d0dadac071c4d33335a9ea4b8e76cf, 0455bef69028c65065f16bb04635591b2374249b, c490a0b5a4f36da3918181a8acdc6991d967c5f3, c490a0b5a4f36da3918181a8acdc6991d967c5f3, c490a0b5a4f36da3918181a8acdc6991d967c5f3, 18e28817cb516b39de6281f6db9b0618b2cc7b42, adf0112d9b8acb03485624220b4934f69bf13369, 9be7fa7ead18a48940df7b59d993bbc8b9055c15, 4.19.257, 5.4.212, 5.10.140, 5.15.64, 4.9.327, 4.14.292, 5.19.6unaffected
LinuxLinux6.0, 0, 4.19.312, 5.4.274, 5.10.173, 5.15.100, 6.1.18, 6.2.5, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.