CVE-2023-53019

HIGH

Linux Kernel 4.5-4.14.305 - Out-of-Bounds Access in MDIO Bus PHY Address Handling

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: net: mdio: validate parameter addr in mdiobus_get_phy() The caller may pass any value as addr, what may result in an out-of-bounds access to array mdio_map. One existing case is stmmac_init_phy() that may pass -1 as addr. Therefore validate addr before using it.

References (7)

Core 7

Scores

CVSS v3 7.8
EPSS 0.0016
EPSS Percentile 6.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-129
Status published
Products (18)
Linux/Linux < 4.5
Linux/Linux 4.14.305 - 4.14.*
Linux/Linux 4.19.272 - 4.19.*
Linux/Linux 4.5
Linux/Linux 5.10.166 - 5.10.*
Linux/Linux 5.15.91 - 5.15.*
Linux/Linux 5.4.231 - 5.4.*
Linux/Linux 6.1.9 - 6.1.*
Linux/Linux 6.2
Linux/Linux 7f854420fbfe9d49afe2ffb1df052cfe8e215541 - 1d80c259dfbadefa61b7ea334dfce5cb57f8c72f
... and 8 more
Published Mar 27, 2025
Tracked Since Feb 18, 2026