{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53729","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-10-22T13:21:37.349Z","datePublished":"2025-10-22T13:23:57.739Z","dateUpdated":"2026-08-05T09:15:43.640Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:15:43.640Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: qmi_encdec: Restrict string length in decode\n\nThe QMI TLV value for strings in a lot of qmi element info structures\naccount for null terminated strings with MAX_LEN + 1. If a string is\nactually MAX_LEN + 1 length, this will cause an out of bounds access\nwhen the NULL character is appended in decoding."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The decoder is fed by QMI messages arriving on a kernel AF_QIPCRTR socket; an unprivileged local process can create such a socket without any capability check and `sendto()` a local-node port, which `qrtr_local_enqueue()` delivers directly to the in-kernel QMI handle. The alternative source is the modem/WLAN firmware over an on-SoC IPC bus, which is not a network transport either.\nAC:L - Triggering is fully deterministic — craft a QMI TLV whose string length equals `elem_len` and send it to the handle's port; kernel handles autobind within the 16384-entry ephemeral range 0x4000–0x7fff, which is trivially swept or resolved through the QRTR name service. No race, no memory-layout precondition, and no sender check exists in `qmi_handle_message()`.\nPR:L - Only an ordinary local account is needed: `qrtr_create()` enforces no capability, and only binding to a reserved port (unnecessary here) requires CAP_NET_ADMIN. No root, no CAP_NET_ADMIN, and no group membership is required to send to the kernel handle.\nUI:N - The attacker sends the malformed QMI message directly to the always-listening kernel handle; decoding happens in the handle's workqueue with no victim action. No mount, file open, or administrator step is involved.\nS:U - The out-of-bounds write corrupts kernel heap or kernel stack memory within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The off-by-one NUL landing immediately past a slab object is a classic poison-NUL primitive — zeroing the low byte of an adjacent object's length, index, or pointer field converts into an over-read of neighbouring kernel memory. Consistent with treating exploitable memory corruption as enabling arbitrary read.\nI:H - This is an attacker-triggered out-of-bounds write: a zero byte placed one element past a fixed-size array, reaching past the end of the `kzalloc()`ed decode buffer when the string is the trailing struct member, or past a stack-allocated response struct in the ath10k/ath11k/ath12k transaction path. Heap and stack off-by-one NUL overflows are established stepping stones to control-flow hijack.\nA:H - Corrupting the byte past a slab object or a stack frame can damage allocator/adjacent-object state and panic the kernel, and hardened configurations (KASAN, SLUB redzoning) turn the write into an immediate BUG. The attacker can repeat the send indefinitely with no rate limit."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/soc/qcom/qmi_encdec.c"],"versions":[{"version":"9b8a11e82615274d4133aab3cf5aa1c59191f0a2","lessThan":"6b58859e7c4ac357517a59f0801e8ce1b58a8ee2","status":"affected","versionType":"git"},{"version":"9b8a11e82615274d4133aab3cf5aa1c59191f0a2","lessThan":"64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e","status":"affected","versionType":"git"},{"version":"9b8a11e82615274d4133aab3cf5aa1c59191f0a2","lessThan":"2ccab9f82772ead618689d17dbc6950d6bd1e741","status":"affected","versionType":"git"},{"version":"9b8a11e82615274d4133aab3cf5aa1c59191f0a2","lessThan":"b2f39b813d1eed4a522428d1e6acd7dfe9b81579","status":"affected","versionType":"git"},{"version":"9b8a11e82615274d4133aab3cf5aa1c59191f0a2","lessThan":"f6250ecb7fbb934b89539e7e2ba6c1d8555c0975","status":"affected","versionType":"git"},{"version":"9b8a11e82615274d4133aab3cf5aa1c59191f0a2","lessThan":"22ee7c9c7f381be178b4457bc54530002e08e938","status":"affected","versionType":"git"},{"version":"9b8a11e82615274d4133aab3cf5aa1c59191f0a2","lessThan":"8d207400fd6b79c92aeb2f33bb79f62dff904ea2","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/soc/qcom/qmi_encdec.c"],"versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","status":"unaffected","versionType":"semver"},{"version":"4.19.295","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.257","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.195","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.132","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.54","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.5.4","lessThanOrEqual":"6.5.*","status":"unaffected","versionType":"semver"},{"version":"6.6","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"4.19.295"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.4.257"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.10.195"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.15.132"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.1.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.5.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.6"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/6b58859e7c4ac357517a59f0801e8ce1b58a8ee2"},{"url":"https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e"},{"url":"https://git.kernel.org/stable/c/2ccab9f82772ead618689d17dbc6950d6bd1e741"},{"url":"https://git.kernel.org/stable/c/b2f39b813d1eed4a522428d1e6acd7dfe9b81579"},{"url":"https://git.kernel.org/stable/c/f6250ecb7fbb934b89539e7e2ba6c1d8555c0975"},{"url":"https://git.kernel.org/stable/c/22ee7c9c7f381be178b4457bc54530002e08e938"},{"url":"https://git.kernel.org/stable/c/8d207400fd6b79c92aeb2f33bb79f62dff904ea2"}],"title":"soc: qcom: qmi_encdec: Restrict string length in decode","x_generator":{"engine":"bippy-1.2.0"}}}}