// For flags

CVE-2023-53998

hwrng: virtio - Fix race on data_avail and actual data

Severity Score

"-"
*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio - Fix race on data_avail and actual data The virtio rng device kicks off a new entropy request whenever the
data available reaches zero. When a new request occurs at the end
of a read operation, that is, when the result of that request is
only needed by the next reader, then there is a race between the
writing of the new data and the next reader. This is because there is no synchronisation whatsoever between the
writer and the reader. Fix this by writing data_avail with smp_store_release and reading
it with smp_load_acquire when we first enter read. The subsequent
reads are safe because they're either protected by the first load
acquire, or by the completion mechanism. Also remove the redundant zeroing of data_idx in random_recv_done
(data_idx must already be zero at this point) and data_avail in
request_entropy (ditto).

*Credits: N/A
CVSS Scores
Attack Vector
-
Attack Complexity
-
Privileges Required
-
User Interaction
-
Scope
-
Confidentiality
-
Integrity
-
Availability
-
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2025-12-24 CVE Reserved
  • 2025-12-24 CVE Published
  • 2025-12-24 CVE Updated
  • 2025-12-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 2.6.26 < 4.19.291
Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.26 < 4.19.291"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 2.6.26 < 5.4.251
Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.26 < 5.4.251"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 2.6.26 < 5.10.188
Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.26 < 5.10.188"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 2.6.26 < 5.15.121
Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.26 < 5.15.121"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 2.6.26 < 6.1.39
Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.26 < 6.1.39"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 2.6.26 < 6.3.13
Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.26 < 6.3.13"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 2.6.26 < 6.4.4
Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.26 < 6.4.4"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 2.6.26 < 6.5
Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.26 < 6.5"
en
Affected