CVE-2023-53019

HIGH

Linux Kernel 4.5-4.14.305 - Out-of-Bounds Access in MDIO Bus PHY Address Handling

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: net: mdio: validate parameter addr in mdiobus_get_phy() The caller may pass any value as addr, what may result in an out-of-bounds access to array mdio_map. One existing case is stmmac_init_phy() that may pass -1 as addr. Therefore validate addr before using it.

References (7)

Core 7

Scores

CVSS v3 7.8
EPSS 0.0019
EPSS Percentile 8.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-129
Status published
Products (24)
linux/Kernel 4.15.0 - 4.19.272linux
linux/Kernel 4.20.0 - 5.4.231linux
linux/Kernel 4.5.0 - 4.14.305linux
linux/Kernel 5.11.0 - 5.15.91linux
linux/Kernel 5.16.0 - 6.1.9linux
linux/Kernel 5.5.0 - 5.10.166linux
Linux/Linux < 4.5
Linux/Linux 4.14.305 - 4.14.*
Linux/Linux 4.19.272 - 4.19.*
Linux/Linux 4.5
... and 14 more
Published Mar 27, 2025
Tracked Since Feb 18, 2026