{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2023-53729",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2023-53729"
  ],
  "published": "2025-10-22T13:24:27Z",
  "summary": "soc: qcom: qmi_encdec: Restrict string length in decode",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: qmi_encdec: Restrict string length in decode\n\nThe QMI TLV value for strings in a lot of qmi element info structures\naccount for null terminated strings with MAX_LEN + 1. If a string is\nactually MAX_LEN + 1 length, this will cause an out of bounds access\nwhen the NULL character is appended in decoding.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.54",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53729"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6b58859e7c4ac357517a59f0801e8ce1b58a8ee2"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2ccab9f82772ead618689d17dbc6950d6bd1e741"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b2f39b813d1eed4a522428d1e6acd7dfe9b81579"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f6250ecb7fbb934b89539e7e2ba6c1d8555c0975"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/22ee7c9c7f381be178b4457bc54530002e08e938"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8d207400fd6b79c92aeb2f33bb79f62dff904ea2"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:24:39Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The decoder is fed by QMI messages arriving on a kernel AF_QIPCRTR socket; an unprivileged local process can create such a socket without any capability check and `sendto()` a local-node port, which `qrtr_local_enqueue()` delivers directly to the in-kernel QMI handle. The alternative source is the modem/WLAN firmware over an on-SoC IPC bus, which is not a network transport either.\nAC:L - Triggering is fully deterministic \u2014 craft a QMI TLV whose string length equals `elem_len` and send it to the handle's port; kernel handles autobind within the 16384-entry ephemeral range 0x4000\u20130x7fff, which is trivially swept or resolved through the QRTR name service. No race, no memory-layout precondition, and no sender check exists in `qmi_handle_message()`.\nPR:L - Only an ordinary local account is needed: `qrtr_create()` enforces no capability, and only binding to a reserved port (unnecessary here) requires CAP_NET_ADMIN. No root, no CAP_NET_ADMIN, and no group membership is required to send to the kernel handle.\nUI:N - The attacker sends the malformed QMI message directly to the always-listening kernel handle; decoding happens in the handle's workqueue with no victim action. No mount, file open, or administrator step is involved.\nS:U - The out-of-bounds write corrupts kernel heap or kernel stack memory within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The off-by-one NUL landing immediately past a slab object is a classic poison-NUL primitive \u2014 zeroing the low byte of an adjacent object's length, index, or pointer field converts into an over-read of neighbouring kernel memory. Consistent with treating exploitable memory corruption as enabling arbitrary read.\nI:H - This is an attacker-triggered out-of-bounds write: a zero byte placed one element past a fixed-size array, reaching past the end of the `kzalloc()`ed decode buffer when the string is the trailing struct member, or past a stack-allocated response struct in the ath10k/ath11k/ath12k transaction path. Heap and stack off-by-one NUL overflows are established stepping stones to control-flow hijack.\nA:H - Corrupting the byte past a slab object or a stack frame can damage allocator/adjacent-object state and panic the kernel, and hardened configurations (KASAN, SLUB redzoning) turn the write into an immediate BUG. The attacker can repeat the send indefinitely with no rate limit."
    }
  }
}