CVE-2023-53674

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-53674", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-10-07T15:16:59.663Z", "datePublished": "2025-10-07T15:21:30.320Z", "dateUpdated": "2026-08-05T09:15:27.585Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:15:27.585Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: Fix memory leak in devm_clk_notifier_register()\n\ndevm_clk_notifier_register() allocates a devres resource for clk\nnotifier but didn't register that to the device, so the notifier didn't\nget unregistered on device detach and the allocated resource was leaked.\n\nFix the issue by registering the resource through devres_add().\n\nThis issue was found with kmemleak on a Chromebook."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The clk core is reached only through local interfaces \u2014 driver bind/unbind, device probe, and clock rate changes driven by local syscalls (DRM/KMS, ALSA, devfreq, IIO sysfs). There is no path from a remote peer or network packet into `devm_clk_notifier_register()` or `__clk_notify()`.\nAC:L - No race or improbable memory layout is required: once the notifier is left registered, `notifier_count` stays permanently incremented so `__clk_notify()` is guaranteed to walk the stale list entry and dereference the freed `struct clk` on the next rate change, which a local attacker can induce reliably via ordinary GPU/audio/cpufreq activity.\nPR:L - The dangling notifier arises without any attacker privilege \u2014 a probe failure after `devm_clk_notifier_register()` (e.g. `adf4377_probe()`, tegra `pmc`, xlnx clock wizard) leaves it registered at boot \u2014 and an ordinary unprivileged user then reaches the use-after-free by causing any clock rate change and by spraying the freed devm allocation.\nUI:N - No victim action is needed; the stale notifier is left behind automatically on detach or probe failure, and the UAF fires from background clock rate changes with no interaction.\nS:U - The freed memory, the notifier chain, and the resulting corruption are all within the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `__clk_notify()` reads through the freed `cn->clk` pointer on every rate change, and control of the reallocated object plus the callback's dereference of `mux_nb->ops` yields an arbitrary-read primitive over kernel memory.\nI:H - The stale `notifier_block` is invoked through `srcu_notifier_call_chain()` after its containing devm allocation is freed, so heap spraying gives the attacker a controlled indirect call (`mux_nb->ops->get_parent`) and hence control-flow hijack and arbitrary write.\nA:H - Beyond the unbounded devres/`clk_notifier` leak, the use-after-free dereference of the freed `struct clk` and the call through freed function pointers reliably oopses or panics the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clk/clk.c"], "versions": [{"version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163", "lessThan": "a326cf0107b197e649bbaa2a2b1355894826ce32", "status": "affected", "versionType": "git"}, {"version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163", "lessThan": "49451db71b746df990888068961f1033f7c9b734", "status": "affected", "versionType": "git"}, {"version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163", "lessThan": "cb1b04fd4283fc8f9acefe0ddc61ba072ed44877", "status": "affected", "versionType": "git"}, {"version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163", "lessThan": "efbbda79b2881a04dcd0e8f28634933d79e17e49", "status": "affected", "versionType": "git"}, {"version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163", "lessThan": "7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clk/clk.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.121", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.39", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.3.13", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.4.4", "lessThanOrEqual": "6.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.121"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.3.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.4.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a326cf0107b197e649bbaa2a2b1355894826ce32"}, {"url": "https://git.kernel.org/stable/c/49451db71b746df990888068961f1033f7c9b734"}, {"url": "https://git.kernel.org/stable/c/cb1b04fd4283fc8f9acefe0ddc61ba072ed44877"}, {"url": "https://git.kernel.org/stable/c/efbbda79b2881a04dcd0e8f28634933d79e17e49"}, {"url": "https://git.kernel.org/stable/c/7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff"}], "title": "clk: Fix memory leak in devm_clk_notifier_register()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/clk/clk.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a326cf0107b197e649bbaa2a2b1355894826ce32", "status": "affected", "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163", "versionType": "git"}, {"lessThan": "49451db71b746df990888068961f1033f7c9b734", "status": "affected", "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163", "versionType": "git"}, {"lessThan": "cb1b04fd4283fc8f9acefe0ddc61ba072ed44877", "status": "affected", "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163", "versionType": "git"}, {"lessThan": "efbbda79b2881a04dcd0e8f28634933d79e17e49", "status": "affected", "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163", "versionType": "git"}, {"lessThan": "7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff", "status": "affected", "version": "6d30d50d037dfa092f9d5d1fffa348ab4abb7163", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/clk/clk.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.121", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.39", "versionType": "semver"}, {"lessThanOrEqual": "6.3.*", "status": "unaffected", "version": "6.3.13", "versionType": "semver"}, {"lessThanOrEqual": "6.4.*", "status": "unaffected", "version": "6.4.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.5", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EC77775B-EC31-4966-966C-1286C02B2A85", "versionEndExcluding": "5.15.121", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9BD1D4A1-304D-4187-8178-6D7C0050B1AF", "versionEndExcluding": "6.1.39", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "95CB4836-7F5D-4C20-B025-8E046EC87B78", "versionEndExcluding": "6.3.13", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6AB81046-CB69-4115-924C-963B37C41385", "versionEndExcluding": "6.4.4", "versionStartIncluding": "6.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: Fix memory leak in devm_clk_notifier_register()\n\ndevm_clk_notifier_register() allocates a devres resource for clk\nnotifier but didn't register that to the device, so the notifier didn't\nget unregistered on device detach and the allocated resource was leaked.\n\nFix the issue by registering the resource through devres_add().\n\nThis issue was found with kmemleak on a Chromebook."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nclk: Correcci\u00f3n de fuga de memoria en devm_clk_notifier_register()\n\ndevm_clk_notifier_register() asigna un recurso devres para el notificador clk pero no lo registr\u00f3 en el dispositivo, por lo que el notificador no se desregistr\u00f3 al desconectar el dispositivo y el recurso asignado se filtr\u00f3.\n\nSe corrige el problema registrando el recurso a trav\u00e9s de devres_add().\n\nEste problema se detect\u00f3 con kmemleak en un Chromebook."}], "id": "CVE-2023-53674", "lastModified": "2026-10-28T20:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-10-07T16:15:51.370", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/49451db71b746df990888068961f1033f7c9b734"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a326cf0107b197e649bbaa2a2b1355894826ce32"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cb1b04fd4283fc8f9acefe0ddc61ba072ed44877"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/efbbda79b2881a04dcd0e8f28634933d79e17e49"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: clk: Fix memory leak in devm_clk_notifier_register()", "id": "2402263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402263"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2023-53674", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:rhivos:1", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat In-Vehicle Operating System 1"}], "public_date": "2025-10-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-53674\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53674\nhttps://lore.kernel.org/linux-cve-announce/2025100706-CVE-2023-53674-af85@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-10-08T13:35:35.950960+00:00", "updated": "2025-10-08T13:35:35.950988+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}