{"id":"CVE-2023-53331","state":"PUBLISHED","title":"pstore/ram: Check start of empty przs during init","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npstore/ram: Check start of empty przs during init\n\nAfter commit 30696378f68a (\"pstore/ram: Do not treat empty buffers as\nvalid\"), initialization would assume a prz was valid after seeing that\nthe buffer_size is zero (regardless of the buffer start position). This\nunchecked start value means it could be outside the bounds of the buffer,\nleading to future access panics when written to:\n\n sysdump_panic_event+0x3b4/0x5b8\n atomic_notifier_call_chain+0x54/0x90\n panic+0x1c8/0x42c\n die+0x29c/0x2a8\n die_kernel_fault+0x68/0x78\n __do_kernel_fault+0x1c4/0x1e0\n do_bad_area+0x40/0x100\n do_translation_fault+0x68/0x80\n do_mem_abort+0x68/0xf8\n el1_da+0x1c/0xc0\n __raw_writeb+0x38/0x174\n __memcpy_toio+0x40/0xac\n persistent_ram_update+0x44/0x12c\n persistent_ram_write+0x1a8/0x1b8\n ramoops_pstore_write+0x198/0x1e8\n pstore_console_write+0x94/0xe0\n ...\n\nTo avoid this, also check if the prz start is 0 during the initialization\nphase. If not, the next prz sanity check case will discover it (start >\nsize) and zap the buffer back to a sane state.\n\n[kees: update commit log with backtrace and clarifications]","publishedAt":"2025-09-16T16:12:06.788Z","updatedAt":"2026-08-05T09:13:32.268Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e1e3a46706bd4037e8b7407dc660ae6e05b8ac56","status":"affected","lessThan":"89312657337e6e03ad6e9ea1a462bd9c158c85c8","versionType":"git"},{"version":"265242d82a3c6a8bd9120d06b4801f8d7ae9a346","status":"affected","lessThan":"c807ccdd812d18985860504b503899f3140a9549","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"e972231db29b5d1dccc13bf9d5ba55b6979a69ed","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"dc2f60de9a7d3efd982440117dab5579898d808c","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"fedecaeef88899d940b69368c996e8b3b0b8650d","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"e95d7a8a6edd14f8fab44c777dd7281db91f6ae2","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"f77990358628b01bdc03752126ff5f716ea37615","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"25fb4e3402d46f425ec135ef6f09792a4c1b3003","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"fe8c3623ab06603eb760444a032d426542212021","versionType":"git"},{"version":"ec7f99261da9a20d63cbd273511a11a2efe698f2","status":"affected","versionType":"git"},{"version":"f250e4c562a3bd106575032666e9ef46f31231f8","status":"affected","versionType":"git"},{"version":"fffdbf586866e9500b53c9d4b061d3983720375a","status":"affected","versionType":"git"},{"version":"9e969ba431b46b1891c88cea36f722f3bfe8a180","status":"affected","versionType":"git"},{"version":"4.14.96","status":"affected","lessThan":"4.14.326","versionType":"semver"},{"version":"4.19.18","status":"affected","lessThan":"4.19.295","versionType":"semver"},{"version":"3.18.133","status":"affected","lessThan":"3.19","versionType":"semver"},{"version":"4.4.172","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"4.9.153","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.20.5","status":"affected","lessThan":"4.21","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/pstore/ram_core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.0","versionType":"semver"},{"version":"4.14.326","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.295","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.257","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.195","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.132","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.53","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.4.16","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5.3","status":"unaffected","lessThanOrEqual":"6.5.*","versionType":"semver"},{"version":"6.6","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/pstore/ram_core.c"]}],"references":["https://git.kernel.org/stable/c/89312657337e6e03ad6e9ea1a462bd9c158c85c8","https://git.kernel.org/stable/c/c807ccdd812d18985860504b503899f3140a9549","https://git.kernel.org/stable/c/e972231db29b5d1dccc13bf9d5ba55b6979a69ed","https://git.kernel.org/stable/c/dc2f60de9a7d3efd982440117dab5579898d808c","https://git.kernel.org/stable/c/fedecaeef88899d940b69368c996e8b3b0b8650d","https://git.kernel.org/stable/c/e95d7a8a6edd14f8fab44c777dd7281db91f6ae2","https://git.kernel.org/stable/c/f77990358628b01bdc03752126ff5f716ea37615","https://git.kernel.org/stable/c/25fb4e3402d46f425ec135ef6f09792a4c1b3003","https://git.kernel.org/stable/c/fe8c3623ab06603eb760444a032d426542212021"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/53xxx/CVE-2023-53331.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53331","state":"PUBLISHED","datePublished":"2025-09-16T16:12:06.788Z","dateUpdated":"2026-08-05T09:13:32.268Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-09-16T16:08:59.564Z"},"containers":{"cna":{"title":"pstore/ram: Check start of empty przs during init","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npstore/ram: Check start of empty przs during init\n\nAfter commit 30696378f68a (\"pstore/ram: Do not treat empty buffers as\nvalid\"), initialization would assume a prz was valid after seeing that\nthe buffer_size is zero (regardless of the buffer start position). This\nunchecked start value means it could be outside the bounds of the buffer,\nleading to future access panics when written to:\n\n sysdump_panic_event+0x3b4/0x5b8\n atomic_notifier_call_chain+0x54/0x90\n panic+0x1c8/0x42c\n die+0x29c/0x2a8\n die_kernel_fault+0x68/0x78\n __do_kernel_fault+0x1c4/0x1e0\n do_bad_area+0x40/0x100\n do_translation_fault+0x68/0x80\n do_mem_abort+0x68/0xf8\n el1_da+0x1c/0xc0\n __raw_writeb+0x38/0x174\n __memcpy_toio+0x40/0xac\n persistent_ram_update+0x44/0x12c\n persistent_ram_write+0x1a8/0x1b8\n ramoops_pstore_write+0x198/0x1e8\n pstore_console_write+0x94/0xe0\n ...\n\nTo avoid this, also check if the prz start is 0 during the initialization\nphase. If not, the next prz sanity check case will discover it (start >\nsize) and zap the buffer back to a sane state.\n\n[kees: update commit log with backtrace and clarifications]"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e1e3a46706bd4037e8b7407dc660ae6e05b8ac56","status":"affected","lessThan":"89312657337e6e03ad6e9ea1a462bd9c158c85c8","versionType":"git"},{"version":"265242d82a3c6a8bd9120d06b4801f8d7ae9a346","status":"affected","lessThan":"c807ccdd812d18985860504b503899f3140a9549","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"e972231db29b5d1dccc13bf9d5ba55b6979a69ed","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"dc2f60de9a7d3efd982440117dab5579898d808c","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"fedecaeef88899d940b69368c996e8b3b0b8650d","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"e95d7a8a6edd14f8fab44c777dd7281db91f6ae2","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"f77990358628b01bdc03752126ff5f716ea37615","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"25fb4e3402d46f425ec135ef6f09792a4c1b3003","versionType":"git"},{"version":"30696378f68a9e3dad6bfe55938b112e72af00c2","status":"affected","lessThan":"fe8c3623ab06603eb760444a032d426542212021","versionType":"git"},{"version":"ec7f99261da9a20d63cbd273511a11a2efe698f2","status":"affected","versionType":"git"},{"version":"f250e4c562a3bd106575032666e9ef46f31231f8","status":"affected","versionType":"git"},{"version":"fffdbf586866e9500b53c9d4b061d3983720375a","status":"affected","versionType":"git"},{"version":"9e969ba431b46b1891c88cea36f722f3bfe8a180","status":"affected","versionType":"git"},{"version":"4.14.96","status":"affected","lessThan":"4.14.326","versionType":"semver"},{"version":"4.19.18","status":"affected","lessThan":"4.19.295","versionType":"semver"},{"version":"3.18.133","status":"affected","lessThan":"3.19","versionType":"semver"},{"version":"4.4.172","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"4.9.153","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.20.5","status":"affected","lessThan":"4.21","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/pstore/ram_core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.0","versionType":"semver"},{"version":"4.14.326","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.295","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.257","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.195","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.132","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.53","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.4.16","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5.3","status":"unaffected","lessThanOrEqual":"6.5.*","versionType":"semver"},{"version":"6.6","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/pstore/ram_core.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/89312657337e6e03ad6e9ea1a462bd9c158c85c8"},{"url":"https://git.kernel.org/stable/c/c807ccdd812d18985860504b503899f3140a9549"},{"url":"https://git.kernel.org/stable/c/e972231db29b5d1dccc13bf9d5ba55b6979a69ed"},{"url":"https://git.kernel.org/stable/c/dc2f60de9a7d3efd982440117dab5579898d808c"},{"url":"https://git.kernel.org/stable/c/fedecaeef88899d940b69368c996e8b3b0b8650d"},{"url":"https://git.kernel.org/stable/c/e95d7a8a6edd14f8fab44c777dd7281db91f6ae2"},{"url":"https://git.kernel.org/stable/c/f77990358628b01bdc03752126ff5f716ea37615"},{"url":"https://git.kernel.org/stable/c/25fb4e3402d46f425ec135ef6f09792a4c1b3003"},{"url":"https://git.kernel.org/stable/c/fe8c3623ab06603eb760444a032d426542212021"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is confined to local pstore/ramoops initialization and subsequent local writes (pstore console, `/dev/pmsg0` via `persistent_ram_write_user`, or other ramoops backends); there is no network or adjacent-radio entry point into `fs/pstore/ram_core.c`.\nAC:L - Once an empty-but-invalid prz header (valid sig, size 0, non-zero start) is present in persistent RAM—observed in the field and retained across soft reboot on common Android/embedded ramoops deployments—the next write deterministically performs an out-of-bounds update with no race or ASLR dependency; scored Low under the uncertainty/highest-severity rule.\nPR:L - In the highest-impact realistic deployment (Android/ChromeOS-style ramoops with pmsg enabled), an unprivileged local actor can trigger the write through `/dev/pmsg0` (kernel default 0220, often further relaxed on Android) or rely on automatic pstore console writes after boot, without needing real init-namespace root.\nUI:N - No victim action is required: after a vulnerable boot accept of the bad empty buffer, the kernel itself writes via the pstore console on printk/panic, or the attacker writes `/dev/pmsg0` directly.\nS:U - The out-of-bounds write corrupts addresses within the kernel’s own ramoops mapping/security domain and does not cross a VM, IOMMU, or other separate authority boundary.\nC:H - This is an out-of-bounds write through `persistent_ram_update`/`_user` into memory past the logical buffer; per kernel scoring guidance such memory corruption is treated as enabling high confidentiality impact (information disclosure primitives), matching CWE-787 assessment of this CVE.\nI:H - The bug issues a attacker-influenced (pmsg) or kernel-sourced (console) out-of-bounds store via `memcpy_toio`/`copy_from_user` at a corrupted start offset, which is integrity-high memory corruption that can overwrite adjacent mapped persistent-RAM contents and is scored as exploitable for control-flow impact under the OOB-write rule.\nA:H - The demonstrated consequence is a kernel translation fault/oops during the out-of-bounds write (see the fix backtrace through `persistent_ram_write` → `__memcpy_toio`), which is a full availability loss."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T09:13:32.268Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.96","versionEndExcluding":"4.14.326"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.18","versionEndExcluding":"4.19.295"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"5.4.257"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"5.10.195"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"5.15.132"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.1.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.4.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.5.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18.133"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.172"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.153"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20.5"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2023-53331","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-01-14T18:30:13.040006Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","type":"CWE","description":"CWE-787 Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-14T18:32:59.884Z"}}]}}}