From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4610025B665 for ; Fri, 2 May 2025 16:00:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746201651; cv=none; b=owz/FdikwoUBDIXSWOJsVrBZesFVrdfQeM9uLmD5uljDE2fuMOUyUmzueylYyovfaY2ADtqa90Raj30+4nvmeRwnjOs/yxs/v9vDS1HM3fVi6U16KWpWXoLMA6Z1/luXyTEPaiUEYV74tztsVXFSFU9q4v5Z6SDDtoqTXDeb/t4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746201651; c=relaxed/simple; bh=vTksWKqqfbKbKyJbbjLTumj6sSCqv1Q0S2/slUYQNmE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=COxYroLHG2WumP0iW+g2h/erFHErjiJ6Atn88WHQkeqIMsheaHjKylfBTi76U3vrluAc3/J/lyWYuuHBXSGuO3DZ5Q3s063aPXSzXYwJ015m6d/XVbHa6sZ4kl+tBbmWt8N0Bmtm1glnycBV1lGi3qYvdzujYibBG761madbIHc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=l9fBgo1y; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="l9fBgo1y" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C85D9C4CEE4; Fri, 2 May 2025 16:00:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1746201651; bh=vTksWKqqfbKbKyJbbjLTumj6sSCqv1Q0S2/slUYQNmE=; h=From:To:Cc:Subject:Date:Reply-to:From; b=l9fBgo1yipYeOMAYWrtEqb6pcvQAcFzxeMjzxNoGx7XO0otRY3uEh933v3X4r1A/F SC2k+pV0aEkt5hQALSiOzky93gURur5d3twUX8pf4Uxq6+vtg0iru7/1Cv6J1X8JAh n3Nc8AFdbpI5jE8e5co6XYHOUVS93lbdvXPF5GfQ= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2023-53125: net: usb: smsc75xx: Limit packet length to skb->len Date: Fri, 2 May 2025 17:56:30 +0200 Message-ID: <2025050232-CVE-2023-53125-67cf@gregkh> X-Mailer: git-send-email 2.49.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3353; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=FiZ+06zeWRUOdfzXWQnnEvXwWSm0FvG3YjeikhGFWbo=; b=owGbwMvMwCRo6H6F97bub03G02pJDBkir748SV97UnxKbXDW1CXu734sabqtlPKzoWP60pD2L WdSLFV+dsSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEbs1jmCu6zajs9WsXnw2X H9WsTOaaa/JiYinDggPeESlcYi9VFPR2znZ9ObNXYNtbawA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Limit packet length to skb->len Packet length retrieved from skb data may be larger than the actual socket buffer length (up to 9026 bytes). In such case the cloned skb passed up the network stack will leak kernel memory contents. The Linux kernel CVE team has assigned CVE-2023-53125 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 4.14.311 with commit 4a4de0a68b18485c68ab4f0cfa665b1633c6d277 Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 4.19.279 with commit 53966d572d056d6b234cfe76a5f9d60049d3c178 Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 5.4.238 with commit 9fabdd79051a9fe51388df099aff6e4b660fedd2 Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 5.10.176 with commit e294f0aa47e4844f3d3c8766c02accd5a76a7d4e Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 5.15.104 with commit 105db6574281e1e03fcbf87983f4fee111682306 Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 6.1.21 with commit c7bdc137ca163b90917c1eeba4f1937684bd4f8b Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 6.2.8 with commit 8ee5df9c039e37b9d8eb5e3de08bfb7f53d31cb6 Issue introduced in 2.6.34 with commit d0cad871703b898a442e4049c532ec39168e5b57 and fixed in 6.3 with commit d8b228318935044dafe3a5bc07ee71a1f1424b8d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-53125 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/usb/smsc75xx.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/4a4de0a68b18485c68ab4f0cfa665b1633c6d277 https://git.kernel.org/stable/c/53966d572d056d6b234cfe76a5f9d60049d3c178 https://git.kernel.org/stable/c/9fabdd79051a9fe51388df099aff6e4b660fedd2 https://git.kernel.org/stable/c/e294f0aa47e4844f3d3c8766c02accd5a76a7d4e https://git.kernel.org/stable/c/105db6574281e1e03fcbf87983f4fee111682306 https://git.kernel.org/stable/c/c7bdc137ca163b90917c1eeba4f1937684bd4f8b https://git.kernel.org/stable/c/8ee5df9c039e37b9d8eb5e3de08bfb7f53d31cb6 https://git.kernel.org/stable/c/d8b228318935044dafe3a5bc07ee71a1f1424b8d