LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53847: usb-storage: alauda: Fix uninit-value in alauda_check_media()

In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alauda_check_media() Syzbot got KMSAN to complain about access to an uninitialized value in the alauda subdriver of usb-storage: BUG: KMSAN: uninit-value in alauda_transport+0x462/0x57f0 drivers/usb/storage/alauda.c:1137 CPU: 0 PID: 12279 Comm: usb-storage Not tainted 5.3.0-rc7+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x13a/0x2b0 mm/kmsan/kmsan_report.c:108 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:250 alauda_check_media+0x344/0x3310 drivers/usb/storage/alauda.c:460 The problem is that alauda_check_media() doesn't verify that its USB transfer succeeded before trying to use the received data. What should happen if the transfer fails isn't entirely clear, but a reasonably conservative approach is to pretend that no media is present. A similar problem exists in a usb_stor_dbg() call in alauda_get_media_status(). In this case, when an error occurs the call is redundant, because usb_stor_ctrl_transfer() already will print a debugging message. Finally, unrelated to the uninitialized memory access, is the fact that alauda_check_media() performs DMA to a buffer on the stack. Fortunately usb-storage provides a general purpose DMA-able buffer for uses like this. We'll use it instead.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel USB storage bug in the Alauda subdriver. When a USB transfer fails, the driver may still use uninitialized data. The published record does not provide a severity score or evidence of active exploitation, so urgency depends on whether affected systems accept or emulate USB storage devices.

Executive priority

Treat as a targeted kernel maintenance issue, not an internet-wide emergency based on available evidence. Patch through normal kernel update channels, with higher priority for workstations, kiosks, labs, and virtualized environments where untrusted USB storage may be introduced.

Technical view

alauda_check_media() failed to verify usb_stor_ctrl_transfer() success before consuming returned data, triggering a KMSAN uninitialized-value report. The fix treats failed transfers as no media present, removes redundant debug use of failed data, and uses the usb-storage DMA-capable buffer instead of stack DMA.

Likely exposure

Linux systems running affected kernel versions with the usb-storage Alauda subdriver reachable. Exposure is most relevant where users, administrators, guests, or peripherals can attach USB storage devices. The bundle does not identify affected distributions or default module-loading behavior.

Exploitation context

No active exploitation is cited. The record says the issue was found by syzbot/KMSAN, and KEV status is false. The bundle contains no exploitability assessment, proof of concept, or evidence of attacks in the wild.

Researcher notes

The public record is narrow: root cause is unchecked USB transfer status before data use in drivers/usb/storage/alauda.c. Severity, CWE, CVSS, distribution impact, and exploitability are not provided. Analysis should avoid assuming code execution or information disclosure without further vendor evidence.

Mitigation direction

  • Apply vendor Linux kernel updates that include the referenced stable fixes.
  • If packages are unavailable, track distribution guidance for CVE-2023-53847.
  • Limit untrusted physical or virtual USB storage attachment until patched.
  • Prioritize systems where USB devices can be attached by untrusted users.

Validation and detection

  • Inventory Linux kernel versions against vendor advisories for CVE-2023-53847.
  • Confirm deployed kernels include the relevant stable alauda fix commit.
  • Check whether the usb-storage Alauda subdriver can load on exposed systems.
  • Review fleet policy for untrusted USB storage attachment paths.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53847 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe80b0fade09ef1ee67b0898d480d4c588f124d5f, e80b0fade09ef1ee67b0898d480d4c588f124d5f, e80b0fade09ef1ee67b0898d480d4c588f124d5f, e80b0fade09ef1ee67b0898d480d4c588f124d5f, e80b0fade09ef1ee67b0898d480d4c588f124d5f, e80b0fade09ef1ee67b0898d480d4c588f124d5f, e80b0fade09ef1ee67b0898d480d4c588f124d5f, e80b0fade09ef1ee67b0898d480d4c588f124d5funaffected
LinuxLinux2.6.16, 0, 4.14.323, 4.19.292, 5.4.254, 5.10.191, 5.15.127, 6.1.46, 6.4.11, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.