Linux kernel scsi/ses: slab out-of-bounds read in ses_enclosure_data_process during enclosure probe

CVSS 8.1CVE-2023-53803Firmware, BMC & network fabriccurated

Impact

KASAN caught a one-byte slab out-of-bounds read in ses_enclosure_data_process() while systemd-udevd probed an enclosure: the code dereferenced addl_desc_ptr[1] without first checking it stayed within the page. The descriptor data originates from the attached enclosure services device, so malformed or hostile enclosure firmware on a storage or GPU chassis can drive a read past the allocation, panicking the node or spilling adjacent slab bytes. The probe runs unattended at boot and on hotplug, with no user logged in. This is a sibling fix to CVE-2023-7324 in the same walk; the two carry different stable commits and different fix content, so they are listed separately.

Who can reach it

An attached SCSI enclosure services device returning malformed additional descriptors - controllable by whoever owns enclosure/expander firmware or can attach hardware. Triggered automatically by the udev probe; no authentication to the host required.

What to do

Update to a stable kernel containing the fix (commits in the references) and reboot the affected nodes. The ses driver binds to live enclosure devices, so plan this as a drain-and-reboot per chassis rather than a module reload; where enclosure management is unused, blacklisting ses avoids the code path in the meantime.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-53803 https://git.kernel.org/stable/c/0dfe68394cbe1d4fe579fb325ecc813c50528c5a https://git.kernel.org/stable/c/9b4f5028e493cb353a5c8f5c45073eeea0303abd

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.