{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53572","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-10-04T15:14:15.925Z","datePublished":"2025-10-04T15:17:13.089Z","dateUpdated":"2026-08-05T09:14:54.320Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:14:54.320Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: scu: use _safe list iterator to avoid a use after free\n\nThis loop is freeing \"clk\" so it needs to use list_for_each_entry_safe().\nOtherwise it dereferences a freed variable to get the next item on the\nloop."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The defect is in the i.MX8QXP/QM/DXL SCU platform clock-provider probe path (`imx8qxp_clk_probe()` → `imx_clk_scu_unregister()`), entered only through the local OF/device-driver model; no network, adjacent-network, or remote-peer data reaches a clock registration routine, and even the hypothetical re-entry routes (module load, DT overlay) require local system access.\nAC:H - The error branch is only taken when `of_clk_add_hw_provider()` fails, which after ruling out `of_clk_set_defaults()` (no in-tree i.MX8 SCU DT node carries `assigned-clocks`/`assigned-clock-rates`) reduces to a ~40-byte GFP_KERNEL `kzalloc()` failing during boot-time probe — small GFP_KERNEL allocations retry and OOM-kill rather than fail, and an attacker cannot induce memory pressure inside the boot-time probe window, so the precondition is genuinely outside attacker control.\nPR:L - There is no capability check anywhere along the path itself and the memory-pressure condition that would provoke the allocation failure needs no privilege at all; although the only explicit re-probe triggers (module load, DTB/overlay) are root-gated and `suppress_bind_attrs = true` removes the sysfs bind route, the uncertainty is resolved toward the lower privilege bar rather than PR:H.\nUI:N - The use-after-free fires automatically inside the driver's own probe error unwind; no administrator or victim must mount a filesystem, open a device, or take any other action for the freed-list walk to execute.\nS:U - The freed slab object, the wild pointer dereference, and the resulting corruption are all confined to kernel heap and the clk framework's own bookkeeping within a single security authority; no VM, container, IOMMU, or sandbox boundary is crossed.\nC:H - This is a genuine use-after-free read: `clk->node.next` is read from a kmalloc-64 object already returned to the allocator with no lock held, so a concurrently reallocated occupant's contents are consumed as a list pointer and its `clk->hw` field is dereferenced by `clk_unregister()`, which additionally prints `clk->core->name` from that wild pointer to dmesg via `pr_err`/`pr_warn` — per kernel UAF treatment this warrants High.\nI:H - Once the loop follows a stale or reallocated `next` pointer, `clk_hw_unregister()` → `clk_unregister()` performs out-of-lifetime writes through it (`clk->core->ops = &clk_nodrv_ops`, `hlist_del_init()`, `kref_put()`), and the loop body then `kfree()`s that attacker-influenceable address — an arbitrary-free plus wild-write primitive suitable for control-flow-relevant heap corruption.\nA:H - With `init_on_free` the freed `node.next` reads back as NULL and with SLUB poisoning as 0x6b6b..., either way oopsing immediately, and a reallocated object yields wild-pointer dereferences and freelist corruption during boot — on the embedded/automotive i.MX8QXP/QM boards this driver targets, commonly booted with panic_on_oops, that leaves the board unbootable."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/clk/imx/clk-scu.c"],"versions":[{"version":"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4","lessThan":"f95ff838ac39f861d1f95a0f3bbb1e01c2517d79","status":"affected","versionType":"git"},{"version":"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4","lessThan":"08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba","status":"affected","versionType":"git"},{"version":"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4","lessThan":"3d90921f91fc6a8c801d527bb5848c99e335c1cf","status":"affected","versionType":"git"},{"version":"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4","lessThan":"0a719f0e4b6f233979e219baff73923e76a96e09","status":"affected","versionType":"git"},{"version":"77d8f3068c63ee0983f0b5ba3207d3f7cce11be4","lessThan":"632c60ecd25dbacee54d5581fe3aeb834b57010a","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/clk/imx/clk-scu.c"],"versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","status":"unaffected","versionType":"semver"},{"version":"5.15.121","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.39","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.3.13","lessThanOrEqual":"6.3.*","status":"unaffected","versionType":"semver"},{"version":"6.4.4","lessThanOrEqual":"6.4.*","status":"unaffected","versionType":"semver"},{"version":"6.5","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.121"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.1.39"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.3.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.4.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.5"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f95ff838ac39f861d1f95a0f3bbb1e01c2517d79"},{"url":"https://git.kernel.org/stable/c/08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba"},{"url":"https://git.kernel.org/stable/c/3d90921f91fc6a8c801d527bb5848c99e335c1cf"},{"url":"https://git.kernel.org/stable/c/0a719f0e4b6f233979e219baff73923e76a96e09"},{"url":"https://git.kernel.org/stable/c/632c60ecd25dbacee54d5581fe3aeb834b57010a"}],"title":"clk: imx: scu: use _safe list iterator to avoid a use after free","x_generator":{"engine":"bippy-1.2.0"}}}}