CVE-2023-53344 – This CVE-2023-53344 is a Linux kernel vulnerabi... (How to Fix)

Q: What is the severity of CVE-2023-53344?

CVE-2023-53344 has a CVSS score of 5.5 (MEDIUM). This CVE-2023-53344 is a Linux kernel vulnerability in the CAN (Controller Area Network) subsystem's bcm_tx_setup function where uninitialized memory can be accessed when memcpy_from_msg fails, potentially exposing kernel memory contents. It affects Linux systems using CAN networking, particularly automotive, industrial control, and embedded systems. The vulnerability could lead to information disclosure or kernel crashes.

📋 TL;DR

This CVE-2023-53344 is a Linux kernel vulnerability in the CAN (Controller Area Network) subsystem's bcm_tx_setup function where uninitialized memory can be accessed when memcpy_from_msg fails, potentially exposing kernel memory contents. It affects Linux systems using CAN networking, particularly automotive, industrial control, and embedded systems. The vulnerability could lead to information disclosure or kernel crashes.

💻 Affected Systems

Products:

Linux Kernel

Versions: Versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with CAN networking enabled and using the bcm protocol. Most desktop/server systems are not affected unless specifically configured for CAN.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure leading to information leakage, potential privilege escalation if combined with other vulnerabilities, or kernel panic causing system crash.

🟠

Likely Case

Information disclosure of kernel memory contents, potentially exposing sensitive data or causing system instability.

🟢

If Mitigated

Minimal impact with proper kernel hardening and CAN subsystem isolation.

🌐 Internet-Facing: LOW - CAN networks are typically isolated from internet-facing interfaces.

🏢 Internal Only: MEDIUM - Requires local access or network access to CAN interfaces, which are common in industrial/automotive environments.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to interact with CAN network interfaces and trigger specific error conditions in memcpy_from_msg.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 2b4c99f7d9a57ecd644eda9b1fb0a1072414959f, 2e6ad51c709fa794e0ce26003c9c9cd944e3383a, 3fa0f1e0e31b1b73cdf59d4c36c7242e6ef821be, 618b15d09fed6126356101543451d49860db4388, 78bc7f0ab99458221224d3ab97199c0f8e6861f1

Vendor Advisory: https://git.kernel.org/stable/c/2b4c99f7d9a57ecd644eda9b1fb0a1072414959f

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check your distribution's security advisories for specific patched kernel versions. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable CAN bcm protocol

linux

Disable the vulnerable CAN bcm protocol module if not required

modprobe -r can_bcm
echo 'blacklist can_bcm' >> /etc/modprobe.d/blacklist.conf

Restrict CAN interface access

linux

Limit access to CAN network interfaces to trusted users only

chmod 600 /dev/can*
setfacl -m u:trusted_user:rw /dev/can*

🧯 If You Can't Patch

Implement network segmentation to isolate CAN networks from other systems
Apply strict access controls to CAN interfaces and monitor for unusual activity

🔍 How to Verify

Check if Vulnerable:

Check if can_bcm module is loaded: lsmod | grep can_bcm AND check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and can_bcm module loads without issues

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
KMSAN error reports
CAN subsystem crashes in dmesg

Network Indicators:

Unusual CAN bus traffic patterns
Multiple failed CAN message transmissions

SIEM Query:

source="kernel" AND ("KMSAN" OR "uninit-value" OR "can_bcm" OR "bcm_tx_setup")

📊 Metadata

CVE ID: CVE-2023-53344

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-908

EPSS Score: 0.01% exploit probability (1.2th percentile)

Published: September 17, 2025

Last Updated: January 14, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-53344, you might also want to check these: