- Vulnerability/
- CVE-2023-53125
CVE-2023-53125: net: usb: smsc75xx: Limit packet length to skb->len
First published: Fri May 02 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Limit packet length to skb->len Packet length retrieved from skb data may be larger than the actual socket buffer length (up to 9026 bytes). In such case the cloned skb passed up the network stack will leak kernel memory contents.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/4a4de0a68b18485c68ab4f0cfa665b1633c6d277
- https://git.kernel.org/stable/c/53966d572d056d6b234cfe76a5f9d60049d3c178
- https://git.kernel.org/stable/c/9fabdd79051a9fe51388df099aff6e4b660fedd2
- https://git.kernel.org/stable/c/e294f0aa47e4844f3d3c8766c02accd5a76a7d4e
- https://git.kernel.org/stable/c/105db6574281e1e03fcbf87983f4fee111682306
- https://git.kernel.org/stable/c/c7bdc137ca163b90917c1eeba4f1937684bd4f8b
- https://git.kernel.org/stable/c/8ee5df9c039e37b9d8eb5e3de08bfb7f53d31cb6
- https://git.kernel.org/stable/c/d8b228318935044dafe3a5bc07ee71a1f1424b8d
Frequently Asked Questions
What is the severity of CVE-2023-53125?
CVE-2023-53125 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2023-53125?
To fix CVE-2023-53125, you should update to the latest version of the Linux kernel where the vulnerability has been patched.
What specific component is affected by CVE-2023-53125?
CVE-2023-53125 affects the usb subsystem, specifically the smsc75xx driver within the Linux kernel.
What types of attacks can CVE-2023-53125 enable?
CVE-2023-53125 could potentially allow for denial of service attacks due to improper packet length handling.
Is CVE-2023-53125 user exploitable?
CVE-2023-53125 is considered to be exploitable by users with access to the affected system, allowing them to manipulate network packets.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/type
- agent/references
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/source
- agent/last-modified-date
- agent/tags
- agent/event
- vendor/linux
- canonical/linux kernel