{
  "threat_severity" : "Low",
  "public_date" : "2025-09-18T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: Linux kernel: Denial of Service in scsi_ses due to enclosure with no components",
    "id" : "2396534",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2396534"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-1285",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nscsi: ses: Handle enclosure with just a primary component gracefully\nThis reverts commit 3fe97ff3d949 (\"scsi: ses: Don't attach if enclosure\nhas no components\") and introduces proper handling of case where there are\nno detected secondary components, but primary component (enumerated in\nnum_enclosures) does exist. That fix was originally proposed by Ding Hui\n<dinghui@sangfor.com.cn>.\nCompletely ignoring devices that have one primary enclosure and no\nsecondary one results in ses_intf_add() bailing completely\nscsi 2:0:0:254: enclosure has no enumerated components\nscsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such\neven on valid configurations with 1 primary and 0 secondary enclosures as\nbelow:\n# sg_ses /dev/sg0\n3PARdata  SES               3321\nSupported diagnostic pages:\nSupported Diagnostic Pages [sdp] [0x0]\nConfiguration (SES) [cf] [0x1]\nShort Enclosure Status (SES) [ses] [0x8]\n# sg_ses -p cf /dev/sg0\n3PARdata  SES               3321\nConfiguration diagnostic page:\nnumber of secondary subenclosures: 0\ngeneration code: 0x0\nenclosure descriptor list\nSubenclosure identifier: 0 [primary]\nrelative ES process id: 0, number of ES processes: 1\nnumber of type descriptor headers: 1\nenclosure logical identifier (hex): 20000002ac02068d\nenclosure vendor: 3PARdata  product: VV                rev: 3321\ntype descriptor header and text list\nElement type: Unspecified, subenclosure id: 0\nnumber of possible elements: 1\nThe changelog for the original fix follows\n=====\nWe can get a crash when disconnecting the iSCSI session,\nthe call trace like this:\n[ffff00002a00fb70] kfree at ffff00000830e224\n[ffff00002a00fba0] ses_intf_remove at ffff000001f200e4\n[ffff00002a00fbd0] device_del at ffff0000086b6a98\n[ffff00002a00fc50] device_unregister at ffff0000086b6d58\n[ffff00002a00fc70] __scsi_remove_device at ffff00000870608c\n[ffff00002a00fca0] scsi_remove_device at ffff000008706134\n[ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4\n[ffff00002a00fd10] scsi_remove_target at ffff0000087064c0\n[ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4\n[ffff00002a00fdb0] process_one_work at ffff00000810f35c\n[ffff00002a00fe00] worker_thread at ffff00000810f648\n[ffff00002a00fe70] kthread at ffff000008116e98\nIn ses_intf_add, components count could be 0, and kcalloc 0 size scomp,\nbut not saved in edev->component[i].scratch\nIn this situation, edev->component[0].scratch is an invalid pointer,\nwhen kfree it in ses_intf_remove_enclosure, a crash like above would happen\nThe call trace also could be other random cases when kfree cannot catch\nthe invalid pointer\nWe should not use edev->component[] array when the components count is 0\nWe also need check index when use edev->component[] array in\nses_enclosure_data_process\n=====", "A flaw was found in the Linux kernel's `scsi: ses` driver. A local attacker could trigger a kernel crash (oops) by attempting to manage a SCSI enclosure that reports having no components. This could lead to a Denial of Service (DoS) on the affected system." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-11-07T00:00:00Z",
    "advisory" : "RHSA-2023:6583",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-362.8.1.el9_3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-11-07T00:00:00Z",
    "advisory" : "RHSA-2023:6583",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-362.8.1.el9_3"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-53431\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53431\nhttps://lore.kernel.org/linux-cve-announce/2025091857-CVE-2023-53431-7eac@gregkh/T" ],
  "name" : "CVE-2023-53431",
  "csaw" : false
}