CVE-2023-53003
Published: 27 March 2025
Summary
CVE-2023-53003 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 49.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2023-53003 is a use-after-free vulnerability (CWE-416) in the Linux kernel's EDAC/qcom driver. The issue arises because memory for llcc_driv_data, allocated by the LLCC driver, is passed as the private driver info (pvt_info) to the EDAC core. During qcom_edac driver release, this memory is freed, but on subsequent probing of the qcom_edac driver, it attempts to use the freed data, triggering the use-after-free condition.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction required (AV:L/AC:L/UI:N). Successful exploitation leads to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with an overall CVSS v3.1 base score of 7.8 and unchanged scope (S:U). This could potentially allow arbitrary code execution, data corruption, or system crashes on affected systems.
Mitigation is provided through kernel patches available in stable releases, as detailed in the referenced commits. These patches resolve the issue by avoiding the direct passing of llcc_driv_data as pvt_info to the EDAC core, instead referencing it via the platform_data pointer in the qcom_edac driver. Systems should update to a patched kernel version incorporating these fixes, such as those from the linked git.kernel.org stable commits.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59717
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the private driver info to the…
more
EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driver gets probed again, it will try to use the freed data leading to the use-after-free bug. Hence, do not pass llcc_driv_data as pvt_info but rather reference it using the platform_data pointer in the qcom_edac driver.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Linux kernel driver enables local low-priv attackers to achieve arbitrary code execution or system compromise, directly mapping to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely remediation of the use-after-free flaw in the Linux kernel's EDAC/qcom driver through application of available stable patches.
Implements memory protection mechanisms such as address space randomization and non-executable memory to hinder exploitation of the use-after-free vulnerability.
Requires vulnerability scanning to identify the presence of CVE-2023-53003 in kernel versions for prioritization of patching.