{"id":"DEBIAN-CVE-2023-53431","details":"In the Linux kernel, the following vulnerability has been resolved:  scsi: ses: Handle enclosure with just a primary component gracefully  This reverts commit 3fe97ff3d949 (\"scsi: ses: Don't attach if enclosure has no components\") and introduces proper handling of case where there are no detected secondary components, but primary component (enumerated in num_enclosures) does exist. That fix was originally proposed by Ding Hui \u003cdinghui@sangfor.com.cn\u003e.  Completely ignoring devices that have one primary enclosure and no secondary one results in ses_intf_add() bailing completely  \tscsi 2:0:0:254: enclosure has no enumerated components         scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such  even on valid configurations with 1 primary and 0 secondary enclosures as below:  \t# sg_ses /dev/sg0 \t  3PARdata  SES               3321 \tSupported diagnostic pages: \t  Supported Diagnostic Pages [sdp] [0x0] \t  Configuration (SES) [cf] [0x1] \t  Short Enclosure Status (SES) [ses] [0x8] \t# sg_ses -p cf /dev/sg0 \t  3PARdata  SES               3321 \tConfiguration diagnostic page: \t  number of secondary subenclosures: 0 \t  generation code: 0x0 \t  enclosure descriptor list \t    Subenclosure identifier: 0 [primary] \t      relative ES process id: 0, number of ES processes: 1 \t      number of type descriptor headers: 1 \t      enclosure logical identifier (hex): 20000002ac02068d \t      enclosure vendor: 3PARdata  product: VV                rev: 3321 \t  type descriptor header and text list \t    Element type: Unspecified, subenclosure id: 0 \t      number of possible elements: 1  The changelog for the original fix follows  ===== We can get a crash when disconnecting the iSCSI session, the call trace like this:    [ffff00002a00fb70] kfree at ffff00000830e224   [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4   [ffff00002a00fbd0] device_del at ffff0000086b6a98   [ffff00002a00fc50] device_unregister at ffff0000086b6d58   [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c   [ffff00002a00fca0] scsi_remove_device at ffff000008706134   [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4   [ffff00002a00fd10] scsi_remove_target at ffff0000087064c0   [ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4   [ffff00002a00fdb0] process_one_work at ffff00000810f35c   [ffff00002a00fe00] worker_thread at ffff00000810f648   [ffff00002a00fe70] kthread at ffff000008116e98  In ses_intf_add, components count could be 0, and kcalloc 0 size scomp, but not saved in edev-\u003ecomponent[i].scratch  In this situation, edev-\u003ecomponent[0].scratch is an invalid pointer, when kfree it in ses_intf_remove_enclosure, a crash like above would happen The call trace also could be other random cases when kfree cannot catch the invalid pointer  We should not use edev-\u003ecomponent[] array when the components count is 0 We also need check index when use edev-\u003ecomponent[] array in ses_enclosure_data_process =====","modified":"2026-09-15T09:03:01.658244524Z","published":"2025-09-18T16:15:47.070Z","upstream":["CVE-2023-53431"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53431"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53431.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53431.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53431.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}