{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-53274", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-09-16T08:09:37.990Z", "datePublished": "2025-09-16T08:11:09.549Z", "dateUpdated": "2026-08-05T09:13:21.464Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:13:21.464Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mediatek: mt8183: Add back SSPM related clocks\n\nThis reverts commit 860690a93ef23b567f781c1b631623e27190f101.\n\nOn the MT8183, the SSPM related clocks were removed claiming a lack of\nusage. This however causes some issues when the driver was converted to\nthe new simple-probe mechanism. This mechanism allocates enough space\nfor all the clocks defined in the clock driver, not the highest index\nin the DT binding. This leads to out-of-bound writes if their are holes\nin the DT binding or the driver (due to deprecated or unimplemented\nclocks). These errors can go unnoticed and cause memory corruption,\nleading to crashes in unrelated areas, or nothing at all. KASAN will\ndetect them.\n\nAdd the SSPM related clocks back to the MT8183 clock driver to fully\nimplement the DT binding. The SSPM clocks are for the power management\nco-processor, and should never be turned off. They are marked as such." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The OOB writes occur in mtk_clk_simple_probe during platform driver probe of mediatek,mt8183-infracfg/topckgen, reachable only via local boot enumeration, module load, or sysfs bind—not via network or physical device I/O.\nAC:L - The undersized allocation and subsequent clk_data->hws[id] stores happen deterministically on every successful probe of the affected MT8183 clock controllers; no race or attacker-uncontrollable condition is required.\nPR:L - The heap OOB write manifests automatically during normal boot on MT8183 devices (e.g. Chromebook Kukui), so a local unprivileged user can be present to leverage the resulting kernel memory corruption without needing root bind/unbind or CAP_SYS_MODULE.\nUI:N - Driver probe runs as part of normal kernel initialization on matching hardware; no separate victim action such as mounting a filesystem or opening a device is required.\nS:U - The corruption is confined to kernel heap within the same privilege domain and does not cross a VM, IOMMU, or other security authority boundary.\nC:H - Out-of-bounds writes of kernel pointers into adjacent heap memory constitute memory corruption that can be leveraged for information disclosure primitives.\nI:H - The bug is a heap out-of-bounds write of struct clk_hw pointers past the allocated clk_hw_onecell_data array, which per guidance is Integrity High and can enable control-flow hijacking.\nA:H - The fix commit explicitly notes the OOB writes cause memory corruption leading to crashes in unrelated areas, which is Availability High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/mediatek/clk-mt8183.c" ], "versions": [ { "version": "3f37ba7cc385ba07762ffcd7ac38af8c0f84dd3e", "lessThan": "45d69917a4af6c869193f95932dc6d6f15d5ef86", "status": "affected", "versionType": "git" }, { "version": "3f37ba7cc385ba07762ffcd7ac38af8c0f84dd3e", "lessThan": "1eb8d61ac5c9c7ec56bb96d433532807509b9288", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/mediatek/clk-mt8183.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.4.10", "lessThanOrEqual": "6.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.4.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.5" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/45d69917a4af6c869193f95932dc6d6f15d5ef86" }, { "url": "https://git.kernel.org/stable/c/1eb8d61ac5c9c7ec56bb96d433532807509b9288" } ], "title": "clk: mediatek: mt8183: Add back SSPM related clocks", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2023-53274", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-01-14T18:06:27.260606Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T18:12:53.858Z" } } ] } }