CVE-2023-53676

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-53676", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-10-07T15:16:59.664Z", "datePublished": "2025-10-07T15:21:31.757Z", "dateUpdated": "2026-10-15T21:41:33.205Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:15:29.713Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()\n\nThe function lio_target_nacl_info_show() uses sprintf() in a loop to print\ndetails for every iSCSI connection in a session without checking for the\nbuffer length. With enough iSCSI connections it's possible to overflow the\nbuffer provided by configfs and corrupt the memory.\n\nThis patch replaces sprintf() with sysfs_emit_at() that checks for buffer\nboundries."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The attacker-controlled state that causes the overflow \u2014 the number of MC/S connections on a session, plus the InitiatorName/InitiatorAlias/CID/peer-address bytes written OOB \u2014 is delivered entirely over TCP/3260 to the network-bound LIO iSCSI target from an arbitrary number of network hops away. This is the stored-payload pattern: the payload is planted remotely at the iSCSI protocol level and rendered later.\nAC:L - On an MC/S-enabled target (the deployment this was reported against) the attacker deterministically opens the ~25+ connections needed to exceed the 4096-byte page; no race, no memory-layout guess, no unpredictable condition is involved. Each additional login reliably extends the overflow.\nPR:N - iSCSI targets are very commonly run with CHAP disabled (`authentication=0`, or demo mode), and the initiator IQN matching an ACL is merely a string the peer asserts in the login PDU, so an unauthenticated remote peer can establish the multi-connection session. Even the connection-count growth occurs during login processing before any real credential check in that configuration.\nUI:R - The overflow executes when the world-readable configfs attribute `acls/<iqn>/info` is read \u2014 by an administrator, targetcli/rtslib, or a monitoring agent \u2014 which the remote attacker cannot initiate. That read is routine on managed storage nodes but is still a separate party's action.\nS:U - The corruption is kernel memory overwritten by kernel code within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Unbounded page-overflow with attacker-influenced content into adjacent buddy-allocator pages is a memory-corruption primitive that can be steered into slab objects, pointers, or page metadata and leveraged for arbitrary kernel memory disclosure.\nI:H - This is an out-of-bounds write of attacker-controlled length (scaling with connection count, up to megabytes) with partly attacker-chosen bytes (CIDs, peer addresses, StatSN) past the end of a kernel page, giving a strong write primitive suitable for control-flow hijack.\nA:H - Overwriting arbitrary adjacent kernel pages while holding `conn_lock` and `nacl_sess_lock` reliably corrupts unrelated kernel state and causes oops/panic; the attacker can repeat it on every read."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/target/iscsi/iscsi_target_configfs.c"], "versions": [{"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "df349e84c2cb0dd05d98c8e1189c26ab4b116083", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "114b44dddea1f8f99576de3c0e6e9059012002fc", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "2cbe6a88fbdd6e8aeab358eef61472e2de43d6f6", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "bbe3ff47bf09db8956bc2eeb49d2d514d256ad2a", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "5353df78c22623b42a71d51226d228a8413097e2", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "4738bf8b2d3635c2944b81b2a84d97b8c8b0978d", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "0cac6cbb9908309352a5d30c1876882771d3da50", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "801f287c93ff95582b0a2d2163f12870a2f076d4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/target/iscsi/iscsi_target_configfs.c"], "versions": [{"version": "3.1", "status": "affected"}, {"version": "0", "lessThan": "3.1", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.326", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.295", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.257", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.197", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.133", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.55", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5.5", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "4.14.326"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "4.19.295"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.4.257"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.10.197"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.15.133"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.1.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.5.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/df349e84c2cb0dd05d98c8e1189c26ab4b116083"}, {"url": "https://git.kernel.org/stable/c/114b44dddea1f8f99576de3c0e6e9059012002fc"}, {"url": "https://git.kernel.org/stable/c/2cbe6a88fbdd6e8aeab358eef61472e2de43d6f6"}, {"url": "https://git.kernel.org/stable/c/bbe3ff47bf09db8956bc2eeb49d2d514d256ad2a"}, {"url": "https://git.kernel.org/stable/c/5353df78c22623b42a71d51226d228a8413097e2"}, {"url": "https://git.kernel.org/stable/c/4738bf8b2d3635c2944b81b2a84d97b8c8b0978d"}, {"url": "https://git.kernel.org/stable/c/0cac6cbb9908309352a5d30c1876882771d3da50"}, {"url": "https://git.kernel.org/stable/c/801f287c93ff95582b0a2d2163f12870a2f076d4"}], "title": "scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-53676", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:36:24.101967Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:33.205Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-53676", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:36:24.101967Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:36:24.591Z"}}], "cna": {"title": "scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The attacker-controlled state that causes the overflow \u2014 the number of MC/S connections on a session, plus the InitiatorName/InitiatorAlias/CID/peer-address bytes written OOB \u2014 is delivered entirely over TCP/3260 to the network-bound LIO iSCSI target from an arbitrary number of network hops away. This is the stored-payload pattern: the payload is planted remotely at the iSCSI protocol level and rendered later.\nAC:L - On an MC/S-enabled target (the deployment this was reported against) the attacker deterministically opens the ~25+ connections needed to exceed the 4096-byte page; no race, no memory-layout guess, no unpredictable condition is involved. Each additional login reliably extends the overflow.\nPR:N - iSCSI targets are very commonly run with CHAP disabled (`authentication=0`, or demo mode), and the initiator IQN matching an ACL is merely a string the peer asserts in the login PDU, so an unauthenticated remote peer can establish the multi-connection session. Even the connection-count growth occurs during login processing before any real credential check in that configuration.\nUI:R - The overflow executes when the world-readable configfs attribute `acls/<iqn>/info` is read \u2014 by an administrator, targetcli/rtslib, or a monitoring agent \u2014 which the remote attacker cannot initiate. That read is routine on managed storage nodes but is still a separate party's action.\nS:U - The corruption is kernel memory overwritten by kernel code within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Unbounded page-overflow with attacker-influenced content into adjacent buddy-allocator pages is a memory-corruption primitive that can be steered into slab objects, pointers, or page metadata and leveraged for arbitrary kernel memory disclosure.\nI:H - This is an out-of-bounds write of attacker-controlled length (scaling with connection count, up to megabytes) with partly attacker-chosen bytes (CIDs, peer addresses, StatSN) past the end of a kernel page, giving a strong write primitive suitable for control-flow hijack.\nA:H - Overwriting arbitrary adjacent kernel pages while holding `conn_lock` and `nacl_sess_lock` reliably corrupts unrelated kernel state and causes oops/panic; the attacker can repeat it on every read."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "df349e84c2cb0dd05d98c8e1189c26ab4b116083", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "114b44dddea1f8f99576de3c0e6e9059012002fc", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "2cbe6a88fbdd6e8aeab358eef61472e2de43d6f6", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "bbe3ff47bf09db8956bc2eeb49d2d514d256ad2a", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "5353df78c22623b42a71d51226d228a8413097e2", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "4738bf8b2d3635c2944b81b2a84d97b8c8b0978d", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "0cac6cbb9908309352a5d30c1876882771d3da50", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "801f287c93ff95582b0a2d2163f12870a2f076d4", "versionType": "git"}], "programFiles": ["drivers/target/iscsi/iscsi_target_configfs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.1"}, {"status": "unaffected", "version": "0", "lessThan": "3.1", "versionType": "semver"}, {"status": "unaffected", "version": "4.14.326", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.295", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.257", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.197", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.133", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.55", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.5.5", "versionType": "semver", "lessThanOrEqual": "6.5.*"}, {"status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/target/iscsi/iscsi_target_configfs.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/df349e84c2cb0dd05d98c8e1189c26ab4b116083"}, {"url": "https://git.kernel.org/stable/c/114b44dddea1f8f99576de3c0e6e9059012002fc"}, {"url": "https://git.kernel.org/stable/c/2cbe6a88fbdd6e8aeab358eef61472e2de43d6f6"}, {"url": "https://git.kernel.org/stable/c/bbe3ff47bf09db8956bc2eeb49d2d514d256ad2a"}, {"url": "https://git.kernel.org/stable/c/5353df78c22623b42a71d51226d228a8413097e2"}, {"url": "https://git.kernel.org/stable/c/4738bf8b2d3635c2944b81b2a84d97b8c8b0978d"}, {"url": "https://git.kernel.org/stable/c/0cac6cbb9908309352a5d30c1876882771d3da50"}, {"url": "https://git.kernel.org/stable/c/801f287c93ff95582b0a2d2163f12870a2f076d4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()\n\nThe function lio_target_nacl_info_show() uses sprintf() in a loop to print\ndetails for every iSCSI connection in a session without checking for the\nbuffer length. With enough iSCSI connections it's possible to overflow the\nbuffer provided by configfs and corrupt the memory.\n\nThis patch replaces sprintf() with sysfs_emit_at() that checks for buffer\nboundries."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.326", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.295", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.257", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.197", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.133", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.55", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.5.5", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6", "versionStartIncluding": "3.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:15:29.713Z"}}}, "cveMetadata": {"cveId": "CVE-2023-53676", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:33.205Z", "dateReserved": "2025-10-07T15:16:59.664Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-07T15:21:31.757Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/target/iscsi/iscsi_target_configfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "df349e84c2cb0dd05d98c8e1189c26ab4b116083", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "114b44dddea1f8f99576de3c0e6e9059012002fc", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "2cbe6a88fbdd6e8aeab358eef61472e2de43d6f6", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "bbe3ff47bf09db8956bc2eeb49d2d514d256ad2a", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "5353df78c22623b42a71d51226d228a8413097e2", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "4738bf8b2d3635c2944b81b2a84d97b8c8b0978d", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "0cac6cbb9908309352a5d30c1876882771d3da50", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "801f287c93ff95582b0a2d2163f12870a2f076d4", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/target/iscsi/iscsi_target_configfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.1"}, {"lessThan": "3.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.326", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.295", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.257", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.197", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.133", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.55", "versionType": "semver"}, {"lessThanOrEqual": "6.5.*", "status": "unaffected", "version": "6.5.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8A66A03-C115-45B6-BE9F-19E5775AA2FA", "versionEndExcluding": "4.14.326", "versionStartIncluding": "3.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D419C7D6-F33D-4EF8-8950-1CB5DDF6A55D", "versionEndExcluding": "4.19.295", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "834BD148-28EC-43A4-A4F5-458124A1E39F", "versionEndExcluding": "5.4.257", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD17EA9A-DF74-4876-AADC-C204F0716961", "versionEndExcluding": "5.10.197", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "21236FF3-9B2C-4C1A-8780-BC5BCA44AA51", "versionEndExcluding": "5.15.133", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0EFCF8E8-5528-46B9-8C17-B09792899CE0", "versionEndExcluding": "6.1.55", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8CF71E85-DA24-4925-95C5-E5C15DA71AE6", "versionEndExcluding": "6.5.5", "versionStartIncluding": "6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()\n\nThe function lio_target_nacl_info_show() uses sprintf() in a loop to print\ndetails for every iSCSI connection in a session without checking for the\nbuffer length. With enough iSCSI connections it's possible to overflow the\nbuffer provided by configfs and corrupt the memory.\n\nThis patch replaces sprintf() with sysfs_emit_at() that checks for buffer\nboundries."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: target: iscsi: Correcci\u00f3n de desbordamiento de b\u00fafer en lio_target_nacl_info_show()\n\nLa funci\u00f3n lio_target_nacl_info_show() usa sprintf() en un bucle para imprimir detalles para cada conexi\u00f3n iSCSI en una sesi\u00f3n sin comprobar la longitud del b\u00fafer. Con suficientes conexiones iSCSI es posible desbordar el b\u00fafer proporcionado por configfs y corromper la memoria.\n\nEste parche reemplaza sprintf() con sysfs_emit_at() que comprueba los l\u00edmites del b\u00fafer."}], "id": "CVE-2023-53676", "lastModified": "2026-10-28T20:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-53676", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:36:24.101967Z", "version": "2.0.3"}}]}, "published": "2025-10-07T16:15:51.653", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0cac6cbb9908309352a5d30c1876882771d3da50"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/114b44dddea1f8f99576de3c0e6e9059012002fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2cbe6a88fbdd6e8aeab358eef61472e2de43d6f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4738bf8b2d3635c2944b81b2a84d97b8c8b0978d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5353df78c22623b42a71d51226d228a8413097e2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/801f287c93ff95582b0a2d2163f12870a2f076d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bbe3ff47bf09db8956bc2eeb49d2d514d256ad2a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/df349e84c2cb0dd05d98c8e1189c26ab4b116083"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()", "id": "2402191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402191"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2023-53676", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:rhivos:1", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat In-Vehicle Operating System 1"}], "public_date": "2025-10-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-53676\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53676\nhttps://lore.kernel.org/linux-cve-announce/2025100707-CVE-2023-53676-e7fb@gregkh/T"], "threat_severity": "Important"}

{"created": "2025-10-08T13:35:26.994205+00:00", "updated": "2025-10-08T13:35:26.994231+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}