| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025050232-CVE-2023-53125-67cf@gregkh> Date: Fri, 2 May 2025 17:56:30 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2023-53125: net: usb: smsc75xx: Limit packet length to skb->len From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Limit packet length to skb->len Packet length retrieved from skb data may be larger than the actual socket buffer length (up to 9026 bytes). In such case the cloned skb passed up the network stack will leak kernel memory contents. The Linux kernel CVE team has assigned CVE-2023-53125 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 4.14.311 with commit 4a4de0a68b18485c68ab4f0cfa665b1633c6d277 Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 4.19.279 with commit 53966d572d056d6b234cfe76a5f9d60049d3c178 Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 5.4.238 with commit 9fabdd79051a9fe51388df099aff6e4b660fedd2 Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 5.10.176 with commit e294f0aa47e4844f3d3c8766c02accd5a76a7d4e Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 5.15.104 with commit 105db6574281e1e03fcbf87983f4fee111682306 Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 6.1.21 with commit c7bdc137ca163b90917c1eeba4f1937684bd4f8b Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 6.2.8 with commit 8ee5df9c039e37b9d8eb5e3de08bfb7f53d31cb6 Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 6.3 with commit d8b228318935044dafe3a5bc07ee71a1f1424b8d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-53125 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/usb/smsc75xx.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/4a4de0a68b18485c68ab4f0cfa665b1633c6d277 https://git.kernel.org/stable/c/53966d572d056d6b234cfe76a5f9d60049d3c178 https://git.kernel.org/stable/c/9fabdd79051a9fe51388df099aff6e4b660fedd2 https://git.kernel.org/stable/c/e294f0aa47e4844f3d3c8766c02accd5a76a7d4e https://git.kernel.org/stable/c/105db6574281e1e03fcbf87983f4fee111682306 https://git.kernel.org/stable/c/c7bdc137ca163b90917c1eeba4f1937684bd4f8b https://git.kernel.org/stable/c/8ee5df9c039e37b9d8eb5e3de08bfb7f53d31cb6 https://git.kernel.org/stable/c/d8b228318935044dafe3a5bc07ee71a1f1424b8d
Powered by blists - more mailing lists