CVE-2023-53142 (GCVE-0-2023-53142)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:56 – Updated: 2025-05-04 07:50
VLAI?
Title
ice: copy last block omitted in ice_get_module_eeprom()
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: copy last block omitted in ice_get_module_eeprom() ice_get_module_eeprom() is broken since commit e9c9692c8a81 ("ice: Reimplement module reads used by ethtool") In this refactor, ice_get_module_eeprom() reads the eeprom in blocks of size 8. But the condition that should protect the buffer overflow ignores the last block. The last block always contains zeros. Bug uncovered by ethtool upstream commit 9538f384b535 ("netlink: eeprom: Defer page requests to individual parsers") After this commit, ethtool reads a block with length = 1; to read the SFF-8024 identifier value. unpatched driver: $ ethtool -m enp65s0f0np0 offset 0x90 length 8 Offset Values ------ ------ 0x0090: 00 00 00 00 00 00 00 00 $ ethtool -m enp65s0f0np0 offset 0x90 length 12 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c 00 00 00 00 $ $ ethtool -m enp65s0f0np0 Offset Values ------ ------ 0x0000: 11 06 06 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 01 08 00 0x0070: 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 patched driver: $ ethtool -m enp65s0f0np0 offset 0x90 length 8 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c $ ethtool -m enp65s0f0np0 offset 0x90 length 12 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c 61 6e 6f 78 $ ethtool -m enp65s0f0np0 Identifier : 0x11 (QSFP28) Extended identifier : 0x00 Extended identifier description : 1.5W max. Power consumption Extended identifier description : No CDR in TX, No CDR in RX Extended identifier description : High Power Class (> 3.5 W) not enabled Connector : 0x23 (No separable connector) Transceiver codes : 0x88 0x00 0x00 0x00 0x00 0x00 0x00 0x00 Transceiver type : 40G Ethernet: 40G Base-CR4 Transceiver type : 25G Ethernet: 25G Base-CR CA-N Encoding : 0x05 (64B/66B) BR, Nominal : 25500Mbps Rate identifier : 0x00 Length (SMF,km) : 0km Length (OM3 50um) : 0m Length (OM2 50um) : 0m Length (OM1 62.5um) : 0m Length (Copper or Active cable) : 1m Transmitter technology : 0xa0 (Copper cable unequalized) Attenuation at 2.5GHz : 4db Attenuation at 5.0GHz : 5db Attenuation at 7.0GHz : 7db Attenuation at 12.9GHz : 10db ........ ....
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e9c9692c8a81aacf0854f68ab54dc182f8be38e8 , < c813f7a3161481483ae2077651b21bc217c419e0 (git)
Affected: e9c9692c8a81aacf0854f68ab54dc182f8be38e8 , < 90b40ab29298db3a4879c1d3c4e685184386bce6 (git)
Affected: e9c9692c8a81aacf0854f68ab54dc182f8be38e8 , < 8cfbdda65588e75bfbd93e5ee847efcb4796ad09 (git)
Affected: e9c9692c8a81aacf0854f68ab54dc182f8be38e8 , < 84cba1840e68430325ac133a11be06bfb2f7acd8 (git)
Create a notification for this product.
    Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.103 , ≤ 5.15.* (semver)
Unaffected: 6.1.20 , ≤ 6.1.* (semver)
Unaffected: 6.2.7 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c813f7a3161481483ae2077651b21bc217c419e0",
              "status": "affected",
              "version": "e9c9692c8a81aacf0854f68ab54dc182f8be38e8",
              "versionType": "git"
            },
            {
              "lessThan": "90b40ab29298db3a4879c1d3c4e685184386bce6",
              "status": "affected",
              "version": "e9c9692c8a81aacf0854f68ab54dc182f8be38e8",
              "versionType": "git"
            },
            {
              "lessThan": "8cfbdda65588e75bfbd93e5ee847efcb4796ad09",
              "status": "affected",
              "version": "e9c9692c8a81aacf0854f68ab54dc182f8be38e8",
              "versionType": "git"
            },
            {
              "lessThan": "84cba1840e68430325ac133a11be06bfb2f7acd8",
              "status": "affected",
              "version": "e9c9692c8a81aacf0854f68ab54dc182f8be38e8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.103",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.20",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.7",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: copy last block omitted in ice_get_module_eeprom()\n\nice_get_module_eeprom() is broken since commit e9c9692c8a81 (\"ice:\nReimplement module reads used by ethtool\") In this refactor,\nice_get_module_eeprom() reads the eeprom in blocks of size 8.\nBut the condition that should protect the buffer overflow\nignores the last block. The last block always contains zeros.\n\nBug uncovered by ethtool upstream commit 9538f384b535\n(\"netlink: eeprom: Defer page requests to individual parsers\")\nAfter this commit, ethtool reads a block with length = 1;\nto read the SFF-8024 identifier value.\n\nunpatched driver:\n$ ethtool -m enp65s0f0np0 offset 0x90 length 8\nOffset          Values\n------          ------\n0x0090:         00 00 00 00 00 00 00 00\n$ ethtool -m enp65s0f0np0 offset 0x90 length 12\nOffset          Values\n------          ------\n0x0090:         00 00 01 a0 4d 65 6c 6c 00 00 00 00\n$\n\n$ ethtool -m enp65s0f0np0\nOffset          Values\n------          ------\n0x0000:         11 06 06 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x0010:         00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x0020:         00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x0030:         00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x0040:         00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x0050:         00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x0060:         00 00 00 00 00 00 00 00 00 00 00 00 00 01 08 00\n0x0070:         00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n\npatched driver:\n$ ethtool -m enp65s0f0np0 offset 0x90 length 8\nOffset          Values\n------          ------\n0x0090:         00 00 01 a0 4d 65 6c 6c\n$ ethtool -m enp65s0f0np0 offset 0x90 length 12\nOffset          Values\n------          ------\n0x0090:         00 00 01 a0 4d 65 6c 6c 61 6e 6f 78\n$ ethtool -m enp65s0f0np0\n    Identifier                                : 0x11 (QSFP28)\n    Extended identifier                       : 0x00\n    Extended identifier description           : 1.5W max. Power consumption\n    Extended identifier description           : No CDR in TX, No CDR in RX\n    Extended identifier description           : High Power Class (\u003e 3.5 W) not enabled\n    Connector                                 : 0x23 (No separable connector)\n    Transceiver codes                         : 0x88 0x00 0x00 0x00 0x00 0x00 0x00 0x00\n    Transceiver type                          : 40G Ethernet: 40G Base-CR4\n    Transceiver type                          : 25G Ethernet: 25G Base-CR CA-N\n    Encoding                                  : 0x05 (64B/66B)\n    BR, Nominal                               : 25500Mbps\n    Rate identifier                           : 0x00\n    Length (SMF,km)                           : 0km\n    Length (OM3 50um)                         : 0m\n    Length (OM2 50um)                         : 0m\n    Length (OM1 62.5um)                       : 0m\n    Length (Copper or Active cable)           : 1m\n    Transmitter technology                    : 0xa0 (Copper cable unequalized)\n    Attenuation at 2.5GHz                     : 4db\n    Attenuation at 5.0GHz                     : 5db\n    Attenuation at 7.0GHz                     : 7db\n    Attenuation at 12.9GHz                    : 10db\n    ........\n    ...."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:50:52.954Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c813f7a3161481483ae2077651b21bc217c419e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/90b40ab29298db3a4879c1d3c4e685184386bce6"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cfbdda65588e75bfbd93e5ee847efcb4796ad09"
        },
        {
          "url": "https://git.kernel.org/stable/c/84cba1840e68430325ac133a11be06bfb2f7acd8"
        }
      ],
      "title": "ice: copy last block omitted in ice_get_module_eeprom()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53142",
    "datePublished": "2025-05-02T15:56:12.949Z",
    "dateReserved": "2025-05-02T15:51:43.562Z",
    "dateUpdated": "2025-05-04T07:50:52.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.