CVE-2023-53510

What it actually does

The UFS driver in the Linux kernel fails to correctly manage lrbp->cmd references when ufshcd_queuecommand() is invoked multiple times for the same SCSI command, allowing stale or double-referenced command structures to persist through error and timeout paths in the SCSI error handler.

Why it matters to the business

Systems using UFS storage may experience kernel warnings, command handling failures, or memory corruption that leads to crashes or local privilege escalation, disrupting storage operations and requiring urgent kernel updates across server and container fleets.

How an attack unfolds

An attacker with local access triggers repeated SCSI command submissions that time out, forcing the error handler (scsi_send_eh_cmnd) to re-invoke queuecommand; the flawed reference handling allows reuse of freed or invalid command objects, resulting in memory corruption that can be leveraged for privilege escalation, as seen in related campaigns by VMSCAPE and Container-Optimized OS exploits.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.10.46-1 on Debian 11-14 or commit f3ee24af62681b942bbd799ac77b90a6d7e1fdb1 on stable git trees; apply vendor kernel updates immediately given the 394 days since disclosure and related exploit activity.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking the presence of the commit f3ee24af62681b942bbd799ac77b90a6d7e1fdb1 or verifying lrbp->cmd handling logic in ufshcd.c no longer clears references in error paths; test with SCSI error injection workloads.

Typical attack path

1. Obtain local access on a Linux system with UFS storage
2. Induce SCSI command timeouts via workload or I/O errors
3. Force the SCSI error handler to re-queue commands
4. Trigger the double-queue condition in ufshcd_queuecommand
5. Exploit resulting memory corruption for code execution

How to detect it

Search kernel logs for the warning at ufshcd_queuecommand+0x6f8 and call traces involving scsi_eh_test_devices or scsi_error_handler; inspect dmesg and journalctl for repeated UFS command timeout events followed by error handler activity.

• WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand
• ufshcd_queuecommand+0x6f8/0x9a8
• scsi_send_eh_cmnd+0x2c0/0x960
• scsi_eh_test_devices+0x100/0x314

What your security team should do

• Prioritize kernel upgrades on all UFS-equipped systems within the next 7 days
• Monitor for related kernel CVEs affecting container-optimized OS environments
• Restrict local unprivileged access where possible until patches are applied
• Update EPSS monitoring given the slight upward trend