CVE-2023-53238
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-15

Last updated on: 2025-12-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() The size of array 'priv->ports[]' is INNO_PHY_PORT_NUM. In the for loop, 'i' is used as the index for array 'priv->ports[]' with a check (i > INNO_PHY_PORT_NUM) which indicates that INNO_PHY_PORT_NUM is allowed value for 'i' in the same loop. This > comparison needs to be changed to >=, otherwise it potentially leads to an out of bounds write on the next iteration through the loop
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-15
Last Modified
2025-12-04
Generated
2026-06-16
AI Q&A
2025-09-15
EPSS Evaluated
2026-06-15
NVD
CVE-2023-53238
Affected Vendors & Products
Showing 9 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 4.17 (inc) to 4.19.291 (exc)
linux linux_kernel From 4.20 (inc) to 5.4.253 (exc)
linux linux_kernel From 5.5 (inc) to 5.10.190 (exc)
linux linux_kernel From 5.11 (inc) to 5.15.124 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.43 (exc)
linux linux_kernel From 6.2 (inc) to 6.4.8 (exc)
linux linux_kernel 6.5
linux linux_kernel 6.5
linux linux_kernel 6.5
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an out of bounds write issue in the Linux kernel's hisilicon PHY driver. Specifically, in the function hisi_inno_phy_probe(), an array 'priv->ports[]' is indexed using a variable 'i' in a loop. The size of the array is defined by INNO_PHY_PORT_NUM. The code incorrectly uses a condition 'i > INNO_PHY_PORT_NUM' to check the loop boundary, which allows 'i' to reach the value INNO_PHY_PORT_NUM, causing an out of bounds write on the next iteration. The fix changes the condition to 'i >= INNO_PHY_PORT_NUM' to prevent this out of bounds access.

Impact Analysis

This vulnerability can lead to an out of bounds write in kernel memory, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges, compromising the security and reliability of the affected system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-53238. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart