CVE-2023-53373 is a use-after-free vulnerability in the Linux kernel's cryptographic sequence initialization vector (seqiv) component. It occurs when seqiv incorrectly handles the EBUSY return value, leading to backlogged requests triggering a use-after-free condition. This vulnerability affects Linux kernel versions where the fix has not been applied. With a CVSS score of 7.8 (High), this vulnerability has a local attack vector and low attack complexity, allowing an authenticated local attacker to achieve high confidentiality, integrity, and availability impacts. The EPSS score is very low, indicating a low probability of exploitation. There is currently no evidence of active exploitation, nor is exploit code publicly available on platforms like Metasploit or ExploitDB. Community discussion and media coverage are minimal, suggesting low public awareness and attention to this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.6.25, < 4.14.308CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.15, < 4.19.276CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.20, < 5.4.235CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.5, < 5.10.173CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.11, < 5.15.99CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.