CVE-2023-52703

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52703
In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path syzbot reported that act_len in kalmia_send_init_packet() is uninitialized when passing it to the first usb_bulk_msg error path. Jiri Pirko noted that it's pointless to pass it in the error path, and that the value that would be printed in the second error path would be the value of act_len from the first call to usb_bulk_msg.[1] With this in mind, let's just not pass act_len to the usb_bulk_msg error paths. 1: https://lore.kernel.org/lkml/Y9pY61y1nwTuzMOa@nanopsycho/

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/02df3170c04a8356cd571ab9155a42f030190abc Patch
https://git.kernel.org/stable/c/1b5de7d44890b78519acbcc80d8d1f23ff2872e5 Patch
https://git.kernel.org/stable/c/338f826d3afead6e4df521f7972a4bef04a72efb Patch
https://git.kernel.org/stable/c/525bdcb0838d19d918c7786151ee14661967a030 Patch
https://git.kernel.org/stable/c/723ef7b66f37c0841f5a451ccbce47ee1641e081 Patch
https://git.kernel.org/stable/c/a753352622b4f3c0219e0e9c73114b2848ae6042 Patch
https://git.kernel.org/stable/c/c68f345b7c425b38656e1791a0486769a8797016 Patch
https://git.kernel.org/stable/c/02df3170c04a8356cd571ab9155a42f030190abc Patch
https://git.kernel.org/stable/c/1b5de7d44890b78519acbcc80d8d1f23ff2872e5 Patch
https://git.kernel.org/stable/c/338f826d3afead6e4df521f7972a4bef04a72efb Patch
https://git.kernel.org/stable/c/525bdcb0838d19d918c7786151ee14661967a030 Patch
https://git.kernel.org/stable/c/723ef7b66f37c0841f5a451ccbce47ee1641e081 Patch
https://git.kernel.org/stable/c/a753352622b4f3c0219e0e9c73114b2848ae6042 Patch
https://git.kernel.org/stable/c/c68f345b7c425b38656e1791a0486769a8797016 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.0:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc8:*:*:*:*:*:*
History

23 Sep 2025, 18:54

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.0:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:3.0:rc6:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 3.3 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/02df3170c04a8356cd571ab9155a42f030190abc - () https://git.kernel.org/stable/c/02df3170c04a8356cd571ab9155a42f030190abc - Patch
References () https://git.kernel.org/stable/c/1b5de7d44890b78519acbcc80d8d1f23ff2872e5 - () https://git.kernel.org/stable/c/1b5de7d44890b78519acbcc80d8d1f23ff2872e5 - Patch
References () https://git.kernel.org/stable/c/338f826d3afead6e4df521f7972a4bef04a72efb - () https://git.kernel.org/stable/c/338f826d3afead6e4df521f7972a4bef04a72efb - Patch
References () https://git.kernel.org/stable/c/525bdcb0838d19d918c7786151ee14661967a030 - () https://git.kernel.org/stable/c/525bdcb0838d19d918c7786151ee14661967a030 - Patch
References () https://git.kernel.org/stable/c/723ef7b66f37c0841f5a451ccbce47ee1641e081 - () https://git.kernel.org/stable/c/723ef7b66f37c0841f5a451ccbce47ee1641e081 - Patch
References () https://git.kernel.org/stable/c/a753352622b4f3c0219e0e9c73114b2848ae6042 - () https://git.kernel.org/stable/c/a753352622b4f3c0219e0e9c73114b2848ae6042 - Patch
References () https://git.kernel.org/stable/c/c68f345b7c425b38656e1791a0486769a8797016 - () https://git.kernel.org/stable/c/c68f345b7c425b38656e1791a0486769a8797016 - Patch
CWE CWE-908

21 Nov 2024, 08:40

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/02df3170c04a8356cd571ab9155a42f030190abc - () https://git.kernel.org/stable/c/02df3170c04a8356cd571ab9155a42f030190abc -
References () https://git.kernel.org/stable/c/1b5de7d44890b78519acbcc80d8d1f23ff2872e5 - () https://git.kernel.org/stable/c/1b5de7d44890b78519acbcc80d8d1f23ff2872e5 -
References () https://git.kernel.org/stable/c/338f826d3afead6e4df521f7972a4bef04a72efb - () https://git.kernel.org/stable/c/338f826d3afead6e4df521f7972a4bef04a72efb -
References () https://git.kernel.org/stable/c/525bdcb0838d19d918c7786151ee14661967a030 - () https://git.kernel.org/stable/c/525bdcb0838d19d918c7786151ee14661967a030 -
References () https://git.kernel.org/stable/c/723ef7b66f37c0841f5a451ccbce47ee1641e081 - () https://git.kernel.org/stable/c/723ef7b66f37c0841f5a451ccbce47ee1641e081 -
References () https://git.kernel.org/stable/c/a753352622b4f3c0219e0e9c73114b2848ae6042 - () https://git.kernel.org/stable/c/a753352622b4f3c0219e0e9c73114b2848ae6042 -
References () https://git.kernel.org/stable/c/c68f345b7c425b38656e1791a0486769a8797016 - () https://git.kernel.org/stable/c/c68f345b7c425b38656e1791a0486769a8797016 -

07 Nov 2024, 17:35

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net/usb: kalmia: No pasar act_len en la ruta de error usb_bulk_msg syzbot informó que act_len en kalmia_send_init_packet() no está inicializado al pasarlo a la primera ruta de error usb_bulk_msg. Jiri Pirko señaló que no tiene sentido pasarlo en la ruta de error y que el valor que se imprimiría en la segunda ruta de error sería el valor de act_len de la primera llamada a usb_bulk_msg.[1] Con esto en mente, simplemente no pasemos act_len a las rutas de error usb_bulk_msg. 1: https://lore.kernel.org/lkml/Y9pY61y1nwTuzMOa@nanopsycho/
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.3

21 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-21 16:15

Updated : 2025-09-23 18:54

NVD link : CVE-2023-52703

Mitre link : CVE-2023-52703

CVE.ORG link : CVE-2023-52703

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource