GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53729 (GCVE-0-2023-53729)

Vulnerability from cvelistv5 – Published: 2025-10-22 13:23 – Updated: 2026-08-05 09:15
VLAI
Title
soc: qcom: qmi_encdec: Restrict string length in decode
Summary
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of bounds access when the NULL character is appended in decoding.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9b8a11e82615274d4133aab3cf5aa1c59191f0a2 , < 6b58859e7c4ac357517a59f0801e8ce1b58a8ee2 (git)
Affected: 9b8a11e82615274d4133aab3cf5aa1c59191f0a2 , < 64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e (git)
Affected: 9b8a11e82615274d4133aab3cf5aa1c59191f0a2 , < 2ccab9f82772ead618689d17dbc6950d6bd1e741 (git)
Affected: 9b8a11e82615274d4133aab3cf5aa1c59191f0a2 , < b2f39b813d1eed4a522428d1e6acd7dfe9b81579 (git)
Affected: 9b8a11e82615274d4133aab3cf5aa1c59191f0a2 , < f6250ecb7fbb934b89539e7e2ba6c1d8555c0975 (git)
Affected: 9b8a11e82615274d4133aab3cf5aa1c59191f0a2 , < 22ee7c9c7f381be178b4457bc54530002e08e938 (git)
Affected: 9b8a11e82615274d4133aab3cf5aa1c59191f0a2 , < 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 4.19.295 , ≤ 4.19.* (semver)
Unaffected: 5.4.257 , ≤ 5.4.* (semver)
Unaffected: 5.10.195 , ≤ 5.10.* (semver)
Unaffected: 5.15.132 , ≤ 5.15.* (semver)
Unaffected: 6.1.54 , ≤ 6.1.* (semver)
Unaffected: 6.5.4 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/soc/qcom/qmi_encdec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b58859e7c4ac357517a59f0801e8ce1b58a8ee2",
              "status": "affected",
              "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
              "versionType": "git"
            },
            {
              "lessThan": "64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e",
              "status": "affected",
              "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
              "versionType": "git"
            },
            {
              "lessThan": "2ccab9f82772ead618689d17dbc6950d6bd1e741",
              "status": "affected",
              "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
              "versionType": "git"
            },
            {
              "lessThan": "b2f39b813d1eed4a522428d1e6acd7dfe9b81579",
              "status": "affected",
              "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
              "versionType": "git"
            },
            {
              "lessThan": "f6250ecb7fbb934b89539e7e2ba6c1d8555c0975",
              "status": "affected",
              "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
              "versionType": "git"
            },
            {
              "lessThan": "22ee7c9c7f381be178b4457bc54530002e08e938",
              "status": "affected",
              "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
              "versionType": "git"
            },
            {
              "lessThan": "8d207400fd6b79c92aeb2f33bb79f62dff904ea2",
              "status": "affected",
              "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/soc/qcom/qmi_encdec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.257",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.295",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.257",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.195",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.132",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.54",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.4",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: qmi_encdec: Restrict string length in decode\n\nThe QMI TLV value for strings in a lot of qmi element info structures\naccount for null terminated strings with MAX_LEN + 1. If a string is\nactually MAX_LEN + 1 length, this will cause an out of bounds access\nwhen the NULL character is appended in decoding."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The decoder is fed by QMI messages arriving on a kernel AF_QIPCRTR socket; an unprivileged local process can create such a socket without any capability check and `sendto()` a local-node port, which `qrtr_local_enqueue()` delivers directly to the in-kernel QMI handle. The alternative source is the modem/WLAN firmware over an on-SoC IPC bus, which is not a network transport either.\nAC:L - Triggering is fully deterministic \u2014 craft a QMI TLV whose string length equals `elem_len` and send it to the handle\u0027s port; kernel handles autobind within the 16384-entry ephemeral range 0x4000\u20130x7fff, which is trivially swept or resolved through the QRTR name service. No race, no memory-layout precondition, and no sender check exists in `qmi_handle_message()`.\nPR:L - Only an ordinary local account is needed: `qrtr_create()` enforces no capability, and only binding to a reserved port (unnecessary here) requires CAP_NET_ADMIN. No root, no CAP_NET_ADMIN, and no group membership is required to send to the kernel handle.\nUI:N - The attacker sends the malformed QMI message directly to the always-listening kernel handle; decoding happens in the handle\u0027s workqueue with no victim action. No mount, file open, or administrator step is involved.\nS:U - The out-of-bounds write corrupts kernel heap or kernel stack memory within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The off-by-one NUL landing immediately past a slab object is a classic poison-NUL primitive \u2014 zeroing the low byte of an adjacent object\u0027s length, index, or pointer field converts into an over-read of neighbouring kernel memory. Consistent with treating exploitable memory corruption as enabling arbitrary read.\nI:H - This is an attacker-triggered out-of-bounds write: a zero byte placed one element past a fixed-size array, reaching past the end of the `kzalloc()`ed decode buffer when the string is the trailing struct member, or past a stack-allocated response struct in the ath10k/ath11k/ath12k transaction path. Heap and stack off-by-one NUL overflows are established stepping stones to control-flow hijack.\nA:H - Corrupting the byte past a slab object or a stack frame can damage allocator/adjacent-object state and panic the kernel, and hardened configurations (KASAN, SLUB redzoning) turn the write into an immediate BUG. The attacker can repeat the send indefinitely with no rate limit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:15:43.640Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b58859e7c4ac357517a59f0801e8ce1b58a8ee2"
        },
        {
          "url": "https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ccab9f82772ead618689d17dbc6950d6bd1e741"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2f39b813d1eed4a522428d1e6acd7dfe9b81579"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6250ecb7fbb934b89539e7e2ba6c1d8555c0975"
        },
        {
          "url": "https://git.kernel.org/stable/c/22ee7c9c7f381be178b4457bc54530002e08e938"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d207400fd6b79c92aeb2f33bb79f62dff904ea2"
        }
      ],
      "title": "soc: qcom: qmi_encdec: Restrict string length in decode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53729",
    "datePublished": "2025-10-22T13:23:57.739Z",
    "dateReserved": "2025-10-22T13:21:37.349Z",
    "dateUpdated": "2026-08-05T09:15:43.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53729",
      "date": "2026-09-17",
      "epss": "0.00143",
      "percentile": "0.03964"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53729\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-22T14:15:48.193\",\"lastModified\":\"2026-08-04T10:19:19.303\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsoc: qcom: qmi_encdec: Restrict string length in decode\\n\\nThe QMI TLV value for strings in a lot of qmi element info structures\\naccount for null terminated strings with MAX_LEN + 1. If a string is\\nactually MAX_LEN + 1 length, this will cause an out of bounds access\\nwhen the NULL character is appended in decoding.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/soc/qcom/qmi_encdec.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9b8a11e82615274d4133aab3cf5aa1c59191f0a2\",\"lessThan\":\"6b58859e7c4ac357517a59f0801e8ce1b58a8ee2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b8a11e82615274d4133aab3cf5aa1c59191f0a2\",\"lessThan\":\"64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b8a11e82615274d4133aab3cf5aa1c59191f0a2\",\"lessThan\":\"2ccab9f82772ead618689d17dbc6950d6bd1e741\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b8a11e82615274d4133aab3cf5aa1c59191f0a2\",\"lessThan\":\"b2f39b813d1eed4a522428d1e6acd7dfe9b81579\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b8a11e82615274d4133aab3cf5aa1c59191f0a2\",\"lessThan\":\"f6250ecb7fbb934b89539e7e2ba6c1d8555c0975\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b8a11e82615274d4133aab3cf5aa1c59191f0a2\",\"lessThan\":\"22ee7c9c7f381be178b4457bc54530002e08e938\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b8a11e82615274d4133aab3cf5aa1c59191f0a2\",\"lessThan\":\"8d207400fd6b79c92aeb2f33bb79f62dff904ea2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/soc/qcom/qmi_encdec.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.295\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.257\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.195\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.132\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.54\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5.4\",\"lessThanOrEqual\":\"6.5.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22ee7c9c7f381be178b4457bc54530002e08e938\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2ccab9f82772ead618689d17dbc6950d6bd1e741\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b58859e7c4ac357517a59f0801e8ce1b58a8ee2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8d207400fd6b79c92aeb2f33bb79f62dff904ea2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b2f39b813d1eed4a522428d1e6acd7dfe9b81579\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f6250ecb7fbb934b89539e7e2ba6c1d8555c0975\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:16:22+00:00",
      "cve": "CVE-2023-53729",
      "id": "CVE-2023-53729",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: soc: qcom: qmi_encdec: Restrict string length in decode",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53729.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T17:05:38Z",
      "cve": "CVE-2023-53729",
      "id": "CVE-2023-53729",
      "initial_release_date": "2025-10-22T23:59:01Z",
      "product_status:known_affected": "591",
      "product_status:known_not_affected": "187",
      "product_status:recommended": "310",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53729",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53729.json",
      "version": "43"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.