CVE-2023-53456

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-53456
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53456.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-53456
Downstream
Related
Published
2025-10-01T11:42:27.821Z
Modified
2026-04-11T12:46:47.493520Z
Summary
scsi: qla4xxx: Add length check when parsing nlattrs
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla4xxx: Add length check when parsing nlattrs

There are three places that qla4xxx parses nlattrs:

  • qla4xxxsetchap_entry()

  • qla4xxxifaceset_param()

  • qla4xxxsysfsddbsetparam()

and each of them directly converts the nlattr to specific pointer of structure without length checking. This could be dangerous as those attributes are not validated and a malformed nlattr (e.g., length 0) could result in an OOB read that leaks heap dirty data.

Add the nla_len check before accessing the nlattr data and return EINVAL if the length check fails.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53456.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
00c31889f7513e9ffa6b2b4de8ad6d7f59a61c80
Fixed
cfa6a1a79ed6d336fac7a5d87eb5471e4401829f
Fixed
5925e224cc6edfef57b20447f18323208461309b
Fixed
47f3be62eab50b8cd7e1ae5fc2c4dae687497c34
Fixed
6d65079c69dc1feb817ed71f5bd15e83a7d6832d
Fixed
f61fc650c47849637fa1771a31a11674c824138a
Fixed
25feffb3fbd51ae81d92c65cebc0e932663828b3
Fixed
4ed21975311247bb84e82298eeb359ec0a0fa84d
Fixed
b018c0440b871d8b001c996e95fa4538bd292de6
Fixed
47cd3770e31df942e2bb925a9a855c79ed0662eb

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53456.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.2.0
Fixed
4.14.326
Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
4.19.295
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.257
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.195
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.132
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.53
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.4.16
Type
ECOSYSTEM
Events
Introduced
6.5.0
Fixed
6.5.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53456.json"