{"api_version":"1","generated_at":"2026-10-29T10:21:24+00:00","cve":"CVE-2023-54046","urls":{"html":"https://cve.report/CVE-2023-54046","api":"https://cve.report/api/cve/CVE-2023-54046.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-54046","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-54046"},"summary":{"title":"crypto: essiv - Handle EBUSY correctly","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: essiv - Handle EBUSY correctly\n\nAs it is essiv only handles the special return value of EINPROGERSS,\nwhich means that in all other cases it will free data related to the\nrequest.\n\nHowever, as the caller of essiv may specify MAY_BACKLOG, we also need\nto expect EBUSY and treat it in the same way.  Otherwise backlogged\nrequests will trigger a use-after-free.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-12-24 13:16:06","updated_at":"2026-10-15 22:17:51"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/c61e7d182ee3f3f5ecf18a2964e303d49c539b52","name":"https://git.kernel.org/stable/c/c61e7d182ee3f3f5ecf18a2964e303d49c539b52","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/840a1d3b77c1b062bd62b4733969a5b1efc274ce","name":"https://git.kernel.org/stable/c/840a1d3b77c1b062bd62b4733969a5b1efc274ce","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b5a772adf45a32c68bef28e60621f12617161556","name":"https://git.kernel.org/stable/c/b5a772adf45a32c68bef28e60621f12617161556","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/796e02cca30a67322161f0745e5ce994bbe75605","name":"https://git.kernel.org/stable/c/796e02cca30a67322161f0745e5ce994bbe75605","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/69c67d451fc19d88e54f7d97e8e7c093e08357e1","name":"https://git.kernel.org/stable/c/69c67d451fc19d88e54f7d97e8e7c093e08357e1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a006aa3eedb8bfd6fe317c3cfe9c86ffe76b2385","name":"https://git.kernel.org/stable/c/a006aa3eedb8bfd6fe317c3cfe9c86ffe76b2385","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-54046","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54046","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected be1eb7f78aa8fbe34779c56c266ccd0364604e71 c61e7d182ee3f3f5ecf18a2964e303d49c539b52 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected be1eb7f78aa8fbe34779c56c266ccd0364604e71 796e02cca30a67322161f0745e5ce994bbe75605 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected be1eb7f78aa8fbe34779c56c266ccd0364604e71 840a1d3b77c1b062bd62b4733969a5b1efc274ce git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected be1eb7f78aa8fbe34779c56c266ccd0364604e71 a006aa3eedb8bfd6fe317c3cfe9c86ffe76b2385 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected be1eb7f78aa8fbe34779c56c266ccd0364604e71 69c67d451fc19d88e54f7d97e8e7c093e08357e1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected be1eb7f78aa8fbe34779c56c266ccd0364604e71 b5a772adf45a32c68bef28e60621f12617161556 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.4","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.235 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.173 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.99 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.16 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.2.3 6.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2023","cve_id":"54046","cve":"CVE-2023-54046","epss":"0.001960000","percentile":"0.087150000","score_date":"2026-10-15","updated_at":"2026-10-16 00:06:11"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2023-54046","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-15T21:38:04.568323Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-15T21:41:38.544Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/essiv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c61e7d182ee3f3f5ecf18a2964e303d49c539b52","status":"affected","version":"be1eb7f78aa8fbe34779c56c266ccd0364604e71","versionType":"git"},{"lessThan":"796e02cca30a67322161f0745e5ce994bbe75605","status":"affected","version":"be1eb7f78aa8fbe34779c56c266ccd0364604e71","versionType":"git"},{"lessThan":"840a1d3b77c1b062bd62b4733969a5b1efc274ce","status":"affected","version":"be1eb7f78aa8fbe34779c56c266ccd0364604e71","versionType":"git"},{"lessThan":"a006aa3eedb8bfd6fe317c3cfe9c86ffe76b2385","status":"affected","version":"be1eb7f78aa8fbe34779c56c266ccd0364604e71","versionType":"git"},{"lessThan":"69c67d451fc19d88e54f7d97e8e7c093e08357e1","status":"affected","version":"be1eb7f78aa8fbe34779c56c266ccd0364604e71","versionType":"git"},{"lessThan":"b5a772adf45a32c68bef28e60621f12617161556","status":"affected","version":"be1eb7f78aa8fbe34779c56c266ccd0364604e71","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/essiv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.235","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.173","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.99","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.16","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.235","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.173","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.99","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.16","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.2.3","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.3","versionStartIncluding":"5.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: essiv - Handle EBUSY correctly\n\nAs it is essiv only handles the special return value of EINPROGERSS,\nwhich means that in all other cases it will free data related to the\nrequest.\n\nHowever, as the caller of essiv may specify MAY_BACKLOG, we also need\nto expect EBUSY and treat it in the same way.  Otherwise backlogged\nrequests will trigger a use-after-free."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The essiv AEAD transform is driven only by local paths — dm-crypt block I/O on a locally-mapped encrypted volume, or an AF_ALG socket — with no remote peer parsing attacker data. No network-facing consumer of essiv(aead) exists.\nAC:L - Once a system runs dm-crypt with AEAD+ESSIV over a backlog-queueing crypto accelerator, an attacker can saturate that queue at will with sustained concurrent I/O, so the -EBUSY window is attacker-created rather than incidental.\nPR:L - No capability is required — an unprivileged local user with access to a file on the encrypted volume (or an AF_ALG aead socket) generates the crypto requests that reach essiv_aead_crypt(); dm-crypt setup is pre-existing administrative configuration, not a privilege the attacker must hold.\nUI:N - The vulnerable path is exercised by the attacker's own I/O or socket operations; no victim action is needed beyond the encrypted device already being mapped.\nS:U - The freed buffer and the resulting heap corruption are entirely within the kernel's own memory and security authority, with no crossing into a hypervisor, IOMMU, or other domain.\nC:H - The prematurely freed buffer is still consumed as AAD by the queued request, so reallocated heap contents are read and folded into the authentication tag returned to the caller, and the double-free yields a UAF primitive usable for arbitrary kernel reads.\nI:H - Freeing the same slab pointer two or three times lets an attacker free an object that has since been reallocated, producing overlapping-object type confusion — a well-established route to arbitrary kernel write and control-flow hijack.\nA:H - Use-after-free plus double-free corrupts the SLUB freelist and trips KASAN/BUG_ON, causing kernel oops or panic even when not exploited further."}]}],"providerMetadata":{"dateUpdated":"2026-08-05T09:16:45.094Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/c61e7d182ee3f3f5ecf18a2964e303d49c539b52"},{"url":"https://git.kernel.org/stable/c/796e02cca30a67322161f0745e5ce994bbe75605"},{"url":"https://git.kernel.org/stable/c/840a1d3b77c1b062bd62b4733969a5b1efc274ce"},{"url":"https://git.kernel.org/stable/c/a006aa3eedb8bfd6fe317c3cfe9c86ffe76b2385"},{"url":"https://git.kernel.org/stable/c/69c67d451fc19d88e54f7d97e8e7c093e08357e1"},{"url":"https://git.kernel.org/stable/c/b5a772adf45a32c68bef28e60621f12617161556"}],"title":"crypto: essiv - Handle EBUSY correctly","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2023-54046","datePublished":"2025-12-24T12:22:57.416Z","dateReserved":"2025-12-24T12:21:05.089Z","dateUpdated":"2026-10-15T21:41:38.544Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-12-24 13:16:06","lastModifiedDate":"2026-10-15 22:17:51","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T21:38:04.568323Z","id":"CVE-2023-54046","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"54046","Ordinal":"1","Title":"crypto: essiv - Handle EBUSY correctly","CVE":"CVE-2023-54046","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"54046","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: essiv - Handle EBUSY correctly\n\nAs it is essiv only handles the special return value of EINPROGERSS,\nwhich means that in all other cases it will free data related to the\nrequest.\n\nHowever, as the caller of essiv may specify MAY_BACKLOG, we also need\nto expect EBUSY and treat it in the same way.  Otherwise backlogged\nrequests will trigger a use-after-free.","Type":"Description","Title":"crypto: essiv - Handle EBUSY correctly"}]}}}