CVE-2023-53393 in Linux
Summary
by MITRE • 09/18/2025
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device
Currently, when mlx5_ib_get_hw_stats() is used for device (port_num = 0), there is a special handling in order to use the correct counters, but, port_num is being passed down the stack without any change. Also, some functions assume that port_num >=1. As a result, the following oops can occur.
BUG: unable to handle page fault for address: ffff89510294f1a8 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP
CPU: 8 PID: 1382 Comm: devlink Tainted: G W 6.1.0-rc4_for_upstream_base_2022_11_10_16_12 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:_raw_spin_lock+0xc/0x20 Call Trace: <TASK> mlx5_ib_get_native_port_mdev+0x73/0xe0 [mlx5_ib]
do_get_hw_stats.constprop.0+0x109/0x160 [mlx5_ib]
mlx5_ib_get_hw_stats+0xad/0x180 [mlx5_ib]
ib_setup_device_attrs+0xf0/0x290 [ib_core]
ib_register_device+0x3bb/0x510 [ib_core]
? atomic_notifier_chain_register+0x67/0x80 __mlx5_ib_add+0x2b/0x80 [mlx5_ib]
mlx5r_probe+0xb8/0x150 [mlx5_ib]
? auxiliary_match_id+0x6a/0x90 auxiliary_bus_probe+0x3c/0x70 ? driver_sysfs_add+0x6b/0x90 really_probe+0xcd/0x380 __driver_probe_device+0x80/0x170 driver_probe_device+0x1e/0x90 __device_attach_driver+0x7d/0x100 ? driver_allows_async_probing+0x60/0x60 ? driver_allows_async_probing+0x60/0x60 bus_for_each_drv+0x7b/0xc0 __device_attach+0xbc/0x200 bus_probe_device+0x87/0xa0 device_add+0x404/0x940 ? dev_set_name+0x53/0x70 __auxiliary_device_add+0x43/0x60 add_adev+0x99/0xe0 [mlx5_core]
mlx5_attach_device+0xc8/0x120 [mlx5_core]
mlx5_load_one_devl_locked+0xb2/0xe0 [mlx5_core]
devlink_reload+0x133/0x250 devlink_nl_cmd_reload+0x480/0x570 ? devlink_nl_pre_doit+0x44/0x2b0 genl_family_rcv_msg_doit.isra.0+0xc2/0x110 genl_rcv_msg+0x180/0x2b0 ? devlink_nl_cmd_region_read_dumpit+0x540/0x540 ? devlink_reload+0x250/0x250 ? devlink_put+0x50/0x50 ? genl_family_rcv_msg_doit.isra.0+0x110/0x110 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1f6/0x2c0 netlink_sendmsg+0x237/0x490 sock_sendmsg+0x33/0x40 __sys_sendto+0x103/0x160 ? handle_mm_fault+0x10e/0x290 ? do_user_addr_fault+0x1c0/0x5f0 __x64_sys_sendto+0x25/0x30 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Fix it by setting port_num to 1 in order to get device status and remove unused variable.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/13/2025
The vulnerability described in CVE-2023-53393 affects the Linux kernel's RDMA/mlx5 driver component, specifically within the mlx5_ib_get_hw_stats function. This issue occurs when the function is invoked for device-level operations where port_num is set to zero, creating a mismatch in the expected parameter handling throughout the call stack. The problem stems from the improper propagation of the port_num parameter down the function chain without appropriate adjustment, leading to incorrect counter access patterns that violate kernel memory management principles. The technical flaw manifests as a page fault during kernel execution, specifically at the _raw_spin_lock function, indicating a critical memory access violation that results in system instability.
The operational impact of this vulnerability is significant as it can cause kernel oops conditions and system crashes when the mlx5 driver attempts to gather hardware statistics for device-level operations. The crash occurs during device initialization and registration processes when the ib_register_device function calls into the problematic mlx5_ib_get_hw_stats pathway. This vulnerability affects systems utilizing Mellanox ConnectX series RDMA hardware and can potentially lead to denial of service conditions, particularly in environments where device management and statistics collection are actively performed through devlink interfaces. The issue is particularly concerning in production environments where RDMA functionality is critical for high-performance computing and data center operations.
The fix implemented addresses the root cause by explicitly setting port_num to 1 when retrieving device status information, ensuring proper counter access patterns throughout the function call stack. This modification resolves the parameter propagation issue that was causing the kernel to attempt invalid memory operations. The solution also removes an unused variable, improving code quality and reducing potential attack surface. This remediation aligns with CWE-129: Improper Validation of Array Index and CWE-125: Out-of-Bounds Read patterns commonly found in kernel driver vulnerabilities. The fix follows ATT&CK framework concept T1499.004: Endpoint Denial of Service to address the system stability impact, while also implementing proper parameter validation techniques that prevent invalid memory access patterns.
Security implications extend beyond simple system crashes to potential privilege escalation risks in scenarios where malicious actors could leverage this vulnerability to disrupt services or potentially gain unauthorized access to kernel memory spaces. The vulnerability demonstrates the importance of proper parameter validation in kernel drivers, particularly when dealing with hardware-specific operations that require precise counter access patterns. Organizations should prioritize patching this vulnerability as it represents a critical stability risk for RDMA-enabled systems, particularly those using Mellanox networking hardware in enterprise data center environments where continuous operation is essential. The fix ensures that device-level statistics collection operates correctly without triggering kernel memory management exceptions.