CVE-2023-53062

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-53062
In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc95xx: Limit packet length to skb->len Packet length retrieved from descriptor may be larger than the actual socket buffer length. In such case the cloned skb passed up the network stack will leak kernel memory contents.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/33d1603a38e05886c538129ddfe00bd52d347e7b Patch
https://git.kernel.org/stable/c/70eb25c6a6cde149affe8a587371a3a8ad295ba0 Patch
https://git.kernel.org/stable/c/733580e268a53db1cd01f2251419da91866378f6 Patch
https://git.kernel.org/stable/c/ba6c40227108f8ee428e42eb0337b48ed3001e65 Patch
https://git.kernel.org/stable/c/d3c145a4d24b752c9a1314d5a595014d51471418 Patch
https://git.kernel.org/stable/c/e041bef1adee02999cf24f9a2e15ed452bc363fe Patch
https://git.kernel.org/stable/c/f2111c791d885211714db85f9a06188571c57dd0 Patch
https://git.kernel.org/stable/c/ff821092cf02a70c2bccd2d19269f01e29aa52cf Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*
History

07 Nov 2025, 02:23

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/33d1603a38e05886c538129ddfe00bd52d347e7b - () https://git.kernel.org/stable/c/33d1603a38e05886c538129ddfe00bd52d347e7b - Patch
References () https://git.kernel.org/stable/c/70eb25c6a6cde149affe8a587371a3a8ad295ba0 - () https://git.kernel.org/stable/c/70eb25c6a6cde149affe8a587371a3a8ad295ba0 - Patch
References () https://git.kernel.org/stable/c/733580e268a53db1cd01f2251419da91866378f6 - () https://git.kernel.org/stable/c/733580e268a53db1cd01f2251419da91866378f6 - Patch
References () https://git.kernel.org/stable/c/ba6c40227108f8ee428e42eb0337b48ed3001e65 - () https://git.kernel.org/stable/c/ba6c40227108f8ee428e42eb0337b48ed3001e65 - Patch
References () https://git.kernel.org/stable/c/d3c145a4d24b752c9a1314d5a595014d51471418 - () https://git.kernel.org/stable/c/d3c145a4d24b752c9a1314d5a595014d51471418 - Patch
References () https://git.kernel.org/stable/c/e041bef1adee02999cf24f9a2e15ed452bc363fe - () https://git.kernel.org/stable/c/e041bef1adee02999cf24f9a2e15ed452bc363fe - Patch
References () https://git.kernel.org/stable/c/f2111c791d885211714db85f9a06188571c57dd0 - () https://git.kernel.org/stable/c/f2111c791d885211714db85f9a06188571c57dd0 - Patch
References () https://git.kernel.org/stable/c/ff821092cf02a70c2bccd2d19269f01e29aa52cf - () https://git.kernel.org/stable/c/ff821092cf02a70c2bccd2d19269f01e29aa52cf - Patch
First Time Linux
Linux linux Kernel
CWE CWE-401

05 May 2025, 20:54

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: usb: smsc95xx: Limitar la longitud del paquete a skb->len. La longitud del paquete obtenida del descriptor puede ser mayor que la longitud real del búfer del socket. En tal caso, el skb clonado que se pasa a la pila de red filtrará el contenido de la memoria del kernel.

02 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-02 16:15

Updated : 2025-11-07 02:23

NVD link : CVE-2023-53062

Mitre link : CVE-2023-53062

CVE.ORG link : CVE-2023-53062

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime