← Back to CVE Explorer

CVE-2023-53676

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to overflow the buffer provided by configfs and corrupt the memory. This patch replaces sprintf() with sysfs_emit_at() that checks for buffer boundries.

Severity
HIGH
CVSS score
7.8 (v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-07 16:15:51.653000
Last modified
2026-10-28 20:10:00.163000
View original CVE JSON 
{
  "id": "CVE-2023-53676",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-10-07T16:15:51.653",
  "lastModified": "2026-10-28T20:10:00.163",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()\n\nThe function lio_target_nacl_info_show() uses sprintf() in a loop to print\ndetails for every iSCSI connection in a session without checking for the\nbuffer length. With enough iSCSI connections it's possible to overflow the\nbuffer provided by configfs and corrupt the memory.\n\nThis patch replaces sprintf() with sysfs_emit_at() that checks for buffer\nboundries."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: target: iscsi: Corrección de desbordamiento de búfer en lio_target_nacl_info_show()\n\nLa función lio_target_nacl_info_show() usa sprintf() en un bucle para imprimir detalles para cada conexión iSCSI en una sesión sin comprobar la longitud del búfer. Con suficientes conexiones iSCSI es posible desbordar el búfer proporcionado por configfs y corromper la memoria.\n\nEste parche reemplaza sprintf() con sysfs_emit_at() que comprueba los límites del búfer."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_configfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "lessThan": "df349e84c2cb0dd05d98c8e1189c26ab4b116083",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "lessThan": "114b44dddea1f8f99576de3c0e6e9059012002fc",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "lessThan": "2cbe6a88fbdd6e8aeab358eef61472e2de43d6f6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "lessThan": "bbe3ff47bf09db8956bc2eeb49d2d514d256ad2a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "lessThan": "5353df78c22623b42a71d51226d228a8413097e2",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "lessThan": "4738bf8b2d3635c2944b81b2a84d97b8c8b0978d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "lessThan": "0cac6cbb9908309352a5d30c1876882771d3da50",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "lessThan": "801f287c93ff95582b0a2d2163f12870a2f076d4",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_configfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.1",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.1",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "4.14.326",
              "lessThanOrEqual": "4.14.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "4.19.295",
              "lessThanOrEqual": "4.19.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.4.257",
              "lessThanOrEqual": "5.4.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.197",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.133",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.55",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.5.5",
              "lessThanOrEqual": "6.5.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-15T21:36:24.101967Z",
          "id": "CVE-2023-53676",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.1",
              "versionEndExcluding": "4.14.326",
              "matchCriteriaId": "F8A66A03-C115-45B6-BE9F-19E5775AA2FA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.15",
              "versionEndExcluding": "4.19.295",
              "matchCriteriaId": "D419C7D6-F33D-4EF8-8950-1CB5DDF6A55D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.20",
              "versionEndExcluding": "5.4.257",
              "matchCriteriaId": "834BD148-28EC-43A4-A4F5-458124A1E39F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.5",
              "versionEndExcluding": "5.10.197",
              "matchCriteriaId": "FD17EA9A-DF74-4876-AADC-C204F0716961"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.11",
              "versionEndExcluding": "5.15.133",
              "matchCriteriaId": "21236FF3-9B2C-4C1A-8780-BC5BCA44AA51"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.16",
              "versionEndExcluding": "6.1.55",
              "matchCriteriaId": "0EFCF8E8-5528-46B9-8C17-B09792899CE0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.2",
              "versionEndExcluding": "6.5.5",
              "matchCriteriaId": "8CF71E85-DA24-4925-95C5-E5C15DA71AE6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0cac6cbb9908309352a5d30c1876882771d3da50",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/114b44dddea1f8f99576de3c0e6e9059012002fc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/2cbe6a88fbdd6e8aeab358eef61472e2de43d6f6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/4738bf8b2d3635c2944b81b2a84d97b8c8b0978d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/5353df78c22623b42a71d51226d228a8413097e2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/801f287c93ff95582b0a2d2163f12870a2f076d4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/bbe3ff47bf09db8956bc2eeb49d2d514d256ad2a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/df349e84c2cb0dd05d98c8e1189c26ab4b116083",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}