CVE-2023-52687
In the Linux kernel's safexcel crypto driver, the dma_map_sg() macro can return zero to indicate an error, but the code did not check for this condition. This flaw could allow improper handling of DMA mappings, potentially leading to memory corruption or other security impacts. A patch has been added that checks the return value and ensures previously mapped buffers are properly unmapped.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users employing the safexcel crypto driver.
Real-world impact
An attacker could exploit this flaw to cause denial of service, information disclosure, or possibly execute arbitrary code with kernel privileges.
Why this severity
CVSS v3.1 base score 9.8 (Critical) due to network‑adjacent attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
What to do about it
- 011. Obtain the Linux kernel patch that adds error handling for dma_map_sg() calls in the safexcel crypto driver (addresses CVE-2023-52687).
- 022. Apply the patch to the affected kernel source tree.
- 033. Recompile the kernel with the patch applied.
- 044. Install the updated kernel and reboot the system.
NVD description states the vulnerability has been resolved by adding error handling for dma_map_sg() calls.
Timeline
- May 17, 2024 · May 17, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.