CVE-2023-53675

A bounds-checking flaw was found in the Linux kernel Small Computer System Interface Enclosure Services driver in the way descriptor pointers are validated while processing enclosure data. Missing checks could allow an out-of-bounds access during parsing. A local user could use this flaw to crash the system while enclosure data is processed, resulting in a denial of service.

The ses_enclosure_data_process() routine did not sufficiently validate descriptor pointer positions before dereferencing them, which could allow the parser to read beyond the buffer when a device or crafted input reports malformed enclosure pages. The fix adds strict pointer and length checks to avoid out-of-bounds accesses.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module ses from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.