Cyber Resilience

CVE-2023-53003

High

Published: 27 March 2025

Published
27 March 2025
Modified
01 April 2025
KEV Added
Patch
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0027 51.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-53003 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 49.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).

Deeper analysis

CVE-2023-53003 is a use-after-free vulnerability (CWE-416) in the Linux kernel's EDAC/qcom driver. The issue arises because memory for llcc_driv_data, allocated by the LLCC driver, is passed as the private driver info (pvt_info) to the EDAC core. During qcom_edac driver release, this memory is freed, but on subsequent probing of the qcom_edac driver, it attempts to use the freed data, triggering the use-after-free condition.

A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction required (AV:L/AC:L/UI:N). Successful exploitation leads to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with an overall CVSS v3.1 base score of 7.8 and unchanged scope (S:U). This could potentially allow arbitrary code execution, data corruption, or system crashes on affected systems.

Mitigation is provided through kernel patches available in stable releases, as detailed in the referenced commits. These patches resolve the issue by avoiding the direct passing of llcc_driv_data as pvt_info to the EDAC core, instead referencing it via the platform_data pointer in the qcom_edac driver. Systems should update to a patched kernel version incorporating these fixes, such as those from the linked git.kernel.org stable commits.

EU & UK References

Vulnerability details

In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the private driver info to the…

more

EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driver gets probed again, it will try to use the freed data leading to the use-after-free bug. Hence, do not pass llcc_driv_data as pvt_info but rather reference it using the platform_data pointer in the qcom_edac driver.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Use-after-free in Linux kernel driver enables local low-priv attackers to achieve arbitrary code execution or system compromise, directly mapping to exploitation for privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-23111Same product: Linux Linux Kernel
CVE-2026-31530Same product: Linux Linux Kernel
CVE-2023-52974Same product: Linux Linux Kernel
CVE-2026-43019Same product: Linux Linux Kernel
CVE-2026-23158Same product: Linux Linux Kernel
CVE-2025-21893Same product: Linux Linux Kernel
CVE-2026-31446Same product: Linux Linux Kernel
CVE-2022-49176Same product: Linux Linux Kernel
CVE-2022-49291Same product: Linux Linux Kernel
CVE-2026-31650Same product: Linux Linux Kernel

Affected Assets

linux
linux kernel
6.2 · 4.20 — 5.4.231 · 5.5 — 5.10.166 · 5.11 — 5.15.91

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Mandates timely remediation of the use-after-free flaw in the Linux kernel's EDAC/qcom driver through application of available stable patches.

prevent

Implements memory protection mechanisms such as address space randomization and non-executable memory to hinder exploitation of the use-after-free vulnerability.

detect

Requires vulnerability scanning to identify the presence of CVE-2023-53003 in kernel versions for prioritization of patching.

References