CVE-2023-53274
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-12-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.4 (inc) to 6.4.10 (exc) |
| linux | linux_kernel | 6.5 |
| linux | linux_kernel | 6.5 |
| linux | linux_kernel | 6.5 |
| linux | linux_kernel | 6.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Linux kernel's clock driver for the Mediatek MT8183 platform. The SSPM related clocks were removed, which caused issues when the driver was updated to use the simple-probe mechanism. This mechanism allocates space for all clocks defined in the driver, not just the highest index in the device tree binding. If there are gaps (holes) in the device tree or driver clocks, this can lead to out-of-bound writes, causing memory corruption. Such corruption can lead to crashes in unrelated parts of the system or may go unnoticed. The SSPM clocks are important for the power management co-processor and should never be turned off. The fix was to add these SSPM clocks back to prevent these out-of-bound writes and memory corruption.
How can this vulnerability impact me? :
This vulnerability can cause memory corruption due to out-of-bound writes in the clock driver. This memory corruption can lead to system crashes in unrelated areas, potentially causing instability or denial of service. In some cases, the errors might go unnoticed but still compromise system reliability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by using KASAN (Kernel Address Sanitizer), which will detect out-of-bound writes and memory corruption caused by the issue in the MT8183 clock driver. Specific commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to update the Linux kernel to include the fix that adds back the SSPM related clocks to the MT8183 clock driver, ensuring the DT binding is fully implemented and preventing out-of-bound writes and memory corruption.