| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025100444-CVE-2023-53541-d961@gregkh> Date: Sat, 4 Oct 2025 17:16:55 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2023-53541: mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write When the oob buffer length is not in multiple of words, the oob write function does out-of-bounds read on the oob source buffer at the last iteration. Fix that by always checking length limit on the oob buffer read and fill with 0xff when reaching the end of the buffer to the oob registers. The Linux kernel CVE team has assigned CVE-2023-53541 to this issue. Affected and fixed versions =========================== Issue introduced in 4.2 with commit 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 and fixed in 4.14.326 with commit 2bc3d6ac704ea7263175ea3da663fdbbb7f3dd8b Issue introduced in 4.2 with commit 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 and fixed in 4.19.295 with commit 14b1d00520b4d6a4818364334ce472b79cfc8976 Issue introduced in 4.2 with commit 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 and fixed in 5.4.257 with commit aae45746f4aee9818296e0500e0703e9d8caa5b8 Issue introduced in 4.2 with commit 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 and fixed in 5.10.195 with commit d00b031266514a9395124704630b056a5185ec17 Issue introduced in 4.2 with commit 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 and fixed in 5.15.132 with commit 2353b7bb61e45e7cfd21505d0c6747ac8c9496a1 Issue introduced in 4.2 with commit 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 and fixed in 6.1.54 with commit 45fe4ad7f439799ee1b7b5f80bf82e8b34a98d25 Issue introduced in 4.2 with commit 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 and fixed in 6.5.4 with commit 648d1150a688698e37f7aaf302860180901cb30e Issue introduced in 4.2 with commit 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 and fixed in 6.6 with commit 5d53244186c9ac58cb88d76a0958ca55b83a15cd Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-53541 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/mtd/nand/raw/brcmnand/brcmnand.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/2bc3d6ac704ea7263175ea3da663fdbbb7f3dd8b https://git.kernel.org/stable/c/14b1d00520b4d6a4818364334ce472b79cfc8976 https://git.kernel.org/stable/c/aae45746f4aee9818296e0500e0703e9d8caa5b8 https://git.kernel.org/stable/c/d00b031266514a9395124704630b056a5185ec17 https://git.kernel.org/stable/c/2353b7bb61e45e7cfd21505d0c6747ac8c9496a1 https://git.kernel.org/stable/c/45fe4ad7f439799ee1b7b5f80bf82e8b34a98d25 https://git.kernel.org/stable/c/648d1150a688698e37f7aaf302860180901cb30e https://git.kernel.org/stable/c/5d53244186c9ac58cb88d76a0958ca55b83a15cd
Powered by blists - more mailing lists