CVE-2023-53572

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-53572", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-10-04T15:14:15.925Z", "datePublished": "2025-10-04T15:17:13.089Z", "dateUpdated": "2026-08-05T09:14:54.320Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:14:54.320Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: scu: use _safe list iterator to avoid a use after free\n\nThis loop is freeing \"clk\" so it needs to use list_for_each_entry_safe().\nOtherwise it dereferences a freed variable to get the next item on the\nloop."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The defect is in the i.MX8QXP/QM/DXL SCU platform clock-provider probe path (`imx8qxp_clk_probe()` \u2192 `imx_clk_scu_unregister()`), entered only through the local OF/device-driver model; no network, adjacent-network, or remote-peer data reaches a clock registration routine, and even the hypothetical re-entry routes (module load, DT overlay) require local system access.\nAC:H - The error branch is only taken when `of_clk_add_hw_provider()` fails, which after ruling out `of_clk_set_defaults()` (no in-tree i.MX8 SCU DT node carries `assigned-clocks`/`assigned-clock-rates`) reduces to a ~40-byte GFP_KERNEL `kzalloc()` failing during boot-time probe \u2014 small GFP_KERNEL allocations retry and OOM-kill rather than fail, and an attacker cannot induce memory pressure inside the boot-time probe window, so the precondition is genuinely outside attacker control.\nPR:L - There is no capability check anywhere along the path itself and the memory-pressure condition that would provoke the allocation failure needs no privilege at all; although the only explicit re-probe triggers (module load, DTB/overlay) are root-gated and `suppress_bind_attrs = true` removes the sysfs bind route, the uncertainty is resolved toward the lower privilege bar rather than PR:H.\nUI:N - The use-after-free fires automatically inside the driver's own probe error unwind; no administrator or victim must mount a filesystem, open a device, or take any other action for the freed-list walk to execute.\nS:U - The freed slab object, the wild pointer dereference, and the resulting corruption are all confined to kernel heap and the clk framework's own bookkeeping within a single security authority; no VM, container, IOMMU, or sandbox boundary is crossed.\nC:H - This is a genuine use-after-free read: `clk->node.next` is read from a kmalloc-64 object already returned to the allocator with no lock held, so a concurrently reallocated occupant's contents are consumed as a list pointer and its `clk->hw` field is dereferenced by `clk_unregister()`, which additionally prints `clk->core->name` from that wild pointer to dmesg via `pr_err`/`pr_warn` \u2014 per kernel UAF treatment this warrants High.\nI:H - Once the loop follows a stale or reallocated `next` pointer, `clk_hw_unregister()` \u2192 `clk_unregister()` performs out-of-lifetime writes through it (`clk->core->ops = &clk_nodrv_ops`, `hlist_del_init()`, `kref_put()`), and the loop body then `kfree()`s that attacker-influenceable address \u2014 an arbitrary-free plus wild-write primitive suitable for control-flow-relevant heap corruption.\nA:H - With `init_on_free` the freed `node.next` reads back as NULL and with SLUB poisoning as 0x6b6b..., either way oopsing immediately, and a reallocated object yields wild-pointer dereferences and freelist corruption during boot \u2014 on the embedded/automotive i.MX8QXP/QM boards this driver targets, commonly booted with panic_on_oops, that leaves the board unbootable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clk/imx/clk-scu.c"], "versions": [{"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4", "lessThan": "f95ff838ac39f861d1f95a0f3bbb1e01c2517d79", "status": "affected", "versionType": "git"}, {"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4", "lessThan": "08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba", "status": "affected", "versionType": "git"}, {"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4", "lessThan": "3d90921f91fc6a8c801d527bb5848c99e335c1cf", "status": "affected", "versionType": "git"}, {"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4", "lessThan": "0a719f0e4b6f233979e219baff73923e76a96e09", "status": "affected", "versionType": "git"}, {"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4", "lessThan": "632c60ecd25dbacee54d5581fe3aeb834b57010a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clk/imx/clk-scu.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.121", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.39", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.3.13", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.4.4", "lessThanOrEqual": "6.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.121"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.3.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.4.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f95ff838ac39f861d1f95a0f3bbb1e01c2517d79"}, {"url": "https://git.kernel.org/stable/c/08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba"}, {"url": "https://git.kernel.org/stable/c/3d90921f91fc6a8c801d527bb5848c99e335c1cf"}, {"url": "https://git.kernel.org/stable/c/0a719f0e4b6f233979e219baff73923e76a96e09"}, {"url": "https://git.kernel.org/stable/c/632c60ecd25dbacee54d5581fe3aeb834b57010a"}], "title": "clk: imx: scu: use _safe list iterator to avoid a use after free", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/clk/imx/clk-scu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f95ff838ac39f861d1f95a0f3bbb1e01c2517d79", "status": "affected", "version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4", "versionType": "git"}, {"lessThan": "08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba", "status": "affected", "version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4", "versionType": "git"}, {"lessThan": "3d90921f91fc6a8c801d527bb5848c99e335c1cf", "status": "affected", "version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4", "versionType": "git"}, {"lessThan": "0a719f0e4b6f233979e219baff73923e76a96e09", "status": "affected", "version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4", "versionType": "git"}, {"lessThan": "632c60ecd25dbacee54d5581fe3aeb834b57010a", "status": "affected", "version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/clk/imx/clk-scu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.121", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.39", "versionType": "semver"}, {"lessThanOrEqual": "6.3.*", "status": "unaffected", "version": "6.3.13", "versionType": "semver"}, {"lessThanOrEqual": "6.4.*", "status": "unaffected", "version": "6.4.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.5", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EC77775B-EC31-4966-966C-1286C02B2A85", "versionEndExcluding": "5.15.121", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9BD1D4A1-304D-4187-8178-6D7C0050B1AF", "versionEndExcluding": "6.1.39", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "95CB4836-7F5D-4C20-B025-8E046EC87B78", "versionEndExcluding": "6.3.13", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6AB81046-CB69-4115-924C-963B37C41385", "versionEndExcluding": "6.4.4", "versionStartIncluding": "6.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: scu: use _safe list iterator to avoid a use after free\n\nThis loop is freeing \"clk\" so it needs to use list_for_each_entry_safe().\nOtherwise it dereferences a freed variable to get the next item on the\nloop."}], "id": "CVE-2023-53572", "lastModified": "2026-08-04T10:19:12.867", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-10-04T16:15:52.803", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a719f0e4b6f233979e219baff73923e76a96e09"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3d90921f91fc6a8c801d527bb5848c99e335c1cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/632c60ecd25dbacee54d5581fe3aeb834b57010a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f95ff838ac39f861d1f95a0f3bbb1e01c2517d79"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: clk: imx: scu: use _safe list iterator to avoid a use after free", "id": "2401503", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2401503"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nclk: imx: scu: use _safe list iterator to avoid a use after free\nThis loop is freeing \"clk\" so it needs to use list_for_each_entry_safe().\nOtherwise it dereferences a freed variable to get the next item on the\nloop."], "name": "CVE-2023-53572", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:rhivos:1", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat In-Vehicle Operating System 1"}], "public_date": "2025-10-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-53572\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53572\nhttps://lore.kernel.org/linux-cve-announce/2025100453-CVE-2023-53572-ab85@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-06T14:41:09.812750+00:00", "updated": "2025-10-06T14:41:09.812804+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}