Bug 2402293 (CVE-2023-53675)

Summary:	CVE-2023-53675 kernel: scsi: ses: Fix possible desc_ptr out-of-bounds accesses
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A bounds-checking flaw was found in the Linux kernel Small Computer System Interface Enclosure Services driver in the way descriptor pointers are validated while processing enclosure data. Missing checks could allow an out-of-bounds access during parsing. A local user could use this flaw to crash the system while enclosure data is processed, resulting in a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-10-07 16:07:51 UTC

In the Linux kernel, the following vulnerability has been resolved:

scsi: ses: Fix possible desc_ptr out-of-bounds accesses

Sanitize possible desc_ptr out-of-bounds accesses in
ses_enclosure_data_process().

Comment 1 Jon Moroney 2025-10-07 19:29:04 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025100707-CVE-2023-53675-e7ac@gregkh/T

Comment 7 errata-xmlrpc 2026-01-14 00:07:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:0537 https://access.redhat.com/errata/RHSA-2026:0537

Comment 8 errata-xmlrpc 2026-01-14 00:09:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:0534 https://access.redhat.com/errata/RHSA-2026:0534

Comment 9 errata-xmlrpc 2026-01-14 00:13:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:0533 https://access.redhat.com/errata/RHSA-2026:0533

Comment 10 errata-xmlrpc 2026-01-14 00:19:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:0536 https://access.redhat.com/errata/RHSA-2026:0536

Comment 11 errata-xmlrpc 2026-01-14 00:20:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:0532 https://access.redhat.com/errata/RHSA-2026:0532

Comment 12 errata-xmlrpc 2026-01-14 00:28:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:0535 https://access.redhat.com/errata/RHSA-2026:0535

Comment 13 errata-xmlrpc 2026-01-14 09:47:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:0576 https://access.redhat.com/errata/RHSA-2026:0576

Comment 14 errata-xmlrpc 2026-01-15 01:07:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2026:0643 https://access.redhat.com/errata/RHSA-2026:0643