{"id":"DEBIAN-CVE-2023-53487","details":"In the Linux kernel, the following vulnerability has been resolved:  powerpc/rtas_flash: allow user copy to flash block cache objects  With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare a system firmware update yields a BUG():    kernel BUG at mm/usercopy.c:102!   Oops: Exception in kernel mode, sig: 5 [#1]   LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries   Modules linked in:   CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2   Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860_146) hv:phyp pSeries   NIP:  c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000   REGS: c0000000148c76a0 TRAP: 0700   Not tainted  (6.5.0-rc3+)   MSR:  8000000000029033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e  CR: 24002242  XER: 0000000c   CFAR: c0000000001fbd34 IRQMASK: 0   [ ... GPRs omitted ... ]   NIP usercopy_abort+0xa0/0xb0   LR  usercopy_abort+0x9c/0xb0   Call Trace:     usercopy_abort+0x9c/0xb0 (unreliable)     __check_heap_object+0x1b4/0x1d0     __check_object_size+0x2d0/0x380     rtas_flash_write+0xe4/0x250     proc_reg_write+0xfc/0x160     vfs_write+0xfc/0x4e0     ksys_write+0x90/0x160     system_call_exception+0x178/0x320     system_call_common+0x160/0x2c4  The blocks of the firmware image are copied directly from user memory to objects allocated from flash_block_cache, so flash_block_cache must be created using kmem_cache_create_usercopy() to mark it safe for user access.  [mpe: Trim and indent oops]","modified":"2026-09-15T09:02:45.298343810Z","published":"2025-10-01T12:15:51.637Z","upstream":["CVE-2023-53487"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53487"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.52-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53487.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53487.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53487.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}