CVE-2023-53059

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-53059
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl It is possible to peep kernel page's data by providing larger `insize` in struct cros_ec_command[1] when invoking EC host commands. Fix it by using zeroed memory. [1]: https://elixir.bootlin.com/linux/v6.2/source/include/linux/platform_data/cros_ec_proto.h#L74

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/13493ad6a220cb3f6f3552a16b4f2753a118b633 Patch
https://git.kernel.org/stable/c/a0d8644784f73fa39f57f72f374eefaba2bf48a0 Patch
https://git.kernel.org/stable/c/b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 Patch
https://git.kernel.org/stable/c/eab28bfafcd1245a3510df9aa9eb940589956ea6 Patch
https://git.kernel.org/stable/c/ebea2e16504f40d2c2bac42ad5c5a3de5ce034b4 Patch
https://git.kernel.org/stable/c/f86ff88a1548ccf5a13960c0e7625ca787ea0993 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*
History

27 Jan 2026, 19:07

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/13493ad6a220cb3f6f3552a16b4f2753a118b633 - () https://git.kernel.org/stable/c/13493ad6a220cb3f6f3552a16b4f2753a118b633 - Patch
References () https://git.kernel.org/stable/c/a0d8644784f73fa39f57f72f374eefaba2bf48a0 - () https://git.kernel.org/stable/c/a0d8644784f73fa39f57f72f374eefaba2bf48a0 - Patch
References () https://git.kernel.org/stable/c/b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 - () https://git.kernel.org/stable/c/b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 - Patch
References () https://git.kernel.org/stable/c/eab28bfafcd1245a3510df9aa9eb940589956ea6 - () https://git.kernel.org/stable/c/eab28bfafcd1245a3510df9aa9eb940589956ea6 - Patch
References () https://git.kernel.org/stable/c/ebea2e16504f40d2c2bac42ad5c5a3de5ce034b4 - () https://git.kernel.org/stable/c/ebea2e16504f40d2c2bac42ad5c5a3de5ce034b4 - Patch
References () https://git.kernel.org/stable/c/f86ff88a1548ccf5a13960c0e7625ca787ea0993 - () https://git.kernel.org/stable/c/f86ff88a1548ccf5a13960c0e7625ca787ea0993 - Patch
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

05 May 2025, 20:54

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: platform/chrome: cros_ec_chardev: se corrige la fuga de datos del kernel desde ioctl. Es posible acceder a los datos de la página del kernel proporcionando un valor `insize` mayor en la estructura cros_ec_command[1] al invocar comandos del host EC. Se corrige utilizando memoria a cero. [1]: https://elixir.bootlin.com/linux/v6.2/source/include/linux/platform_data/cros_ec_proto.h#L74

02 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-02 16:15

Updated : 2026-01-27 19:07

NVD link : CVE-2023-53059

Mitre link : CVE-2023-53059

CVE.ORG link : CVE-2023-53059

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo