7.1

CVE-2023-53238

phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()

In the Linux kernel, the following vulnerability has been resolved:

phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()

The size of array 'priv->ports[]' is INNO_PHY_PORT_NUM.

In the for loop, 'i' is used as the index for array 'priv->ports[]'
with a check (i > INNO_PHY_PORT_NUM) which indicates that
INNO_PHY_PORT_NUM is allowed value for 'i' in the same loop.

This > comparison needs to be changed to >=, otherwise it potentially leads
to an out of bounds write on the next iteration through the loop
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.17 < 4.19.291
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.253
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.190
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.124
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.43
Linux ≫ Linux Kernel Version >= 6.2 < 6.4.8
Linux ≫ Linux Kernel Version6.5 Updaterc1
Linux ≫ Linux Kernel Version6.5 Updaterc2
Linux ≫ Linux Kernel Version6.5 Updaterc3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.02% 0.042
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.