linux-cve-announce - CVE-2023-54169: net/mlx5e: fix memory leak in mlx5e_ptp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025123020-CVE-2023-54169-21bb@gregkh>
Date: Tue, 30 Dec 2025 13:09:37 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54169: net/mlx5e: fix memory leak in mlx5e_ptp_open

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: fix memory leak in mlx5e_ptp_open

When kvzalloc_node or kvzalloc failed in mlx5e_ptp_open, the memory
pointed by "c" or "cparams" is not freed, which can lead to a memory
leak. Fix by freeing the array in the error path.

The Linux kernel CVE team has assigned CVE-2023-54169 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit 145e5637d941daec2e8d1ff21676cbf1aa62cf4d and fixed in 5.15.121 with commit 4892e1e548b5bd6524c1c89df06e4849df26fc20
	Issue introduced in 5.11 with commit 145e5637d941daec2e8d1ff21676cbf1aa62cf4d and fixed in 6.1.40 with commit 83a8f7337a14cdb215c76a8f4cf3f3be8b59177d
	Issue introduced in 5.11 with commit 145e5637d941daec2e8d1ff21676cbf1aa62cf4d and fixed in 6.4.5 with commit 7035e3ae600c4e9cb3dc220c24dd77112ddff8b1
	Issue introduced in 5.11 with commit 145e5637d941daec2e8d1ff21676cbf1aa62cf4d and fixed in 6.5 with commit d543b649ffe58a0cb4b6948b3305069c5980a1fa

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54169
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4892e1e548b5bd6524c1c89df06e4849df26fc20
	https://git.kernel.org/stable/c/83a8f7337a14cdb215c76a8f4cf3f3be8b59177d
	https://git.kernel.org/stable/c/7035e3ae600c4e9cb3dc220c24dd77112ddff8b1
	https://git.kernel.org/stable/c/d543b649ffe58a0cb4b6948b3305069c5980a1fa