{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54129", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T13:02:52.521Z", "datePublished": "2025-12-24T13:06:46.817Z", "dateUpdated": "2026-08-05T09:17:30.008Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:30.008Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Add validation for lmac type\n\nUpon physical link change, firmware reports to the kernel about the\nchange along with the details like speed, lmac_type_id, etc.\nKernel derives lmac_type based on lmac_type_id received from firmware.\n\nIn a few scenarios, firmware returns an invalid lmac_type_id, which\nis resulting in below kernel panic. This patch adds the missing\nvalidation of the lmac_type_id field.\n\nInternal error: Oops: 96000005 [#1] PREEMPT SMP\n[ 35.321595] Modules linked in:\n[ 35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted\n5.4.210-g2e3169d8e1bc-dirty #17\n[ 35.337014] Hardware name: Marvell CN103XX board (DT)\n[ 35.344297] Workqueue: events work_for_cpu_fn\n[ 35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO)\n[ 35.360267] pc : strncpy+0x10/0x30\n[ 35.366595] lr : cgx_link_change_handler+0x90/0x180" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The vulnerable parse runs from the CGX/RPM async link-change interrupt (`cgx_fwi_event_handler` → `CGX_EVT_ASYNC`/`CGX_EVT_LINK_CHANGE` → `cgx_link_change_handler`), which fires on physical Ethernet link state and mode transitions on the attached segment. An attacker on the same L2 segment who can flap the link or force renegotiation drives the vulnerable code path without touching the host.\nAC:L - No race, no memory-layout grooming, and no timing window is involved — every link-change event unconditionally indexes `cgx_lmactype_string[]` with the unvalidated 8-bit firmware field, and the attacker can repeat link transitions indefinitely to hit the reporting scenarios. Choosing Low over High since the trigger is repeatable at will.\nPR:N - The asynchronous link-change notification path requires no authentication, no login, and no host credentials — it is driven purely by physical link state on the port. The privilege gate `is_cgx_config_permitted()` guards only the mailbox-initiated variant, not the async event path.\nUI:N - The link-change event is processed automatically in the CGX interrupt handler with no administrator or user action required. Nothing needs to be opened, mounted, or configured by a victim.\nS:U - The out-of-bounds read and resulting fault occur entirely within the kernel's own security authority on the AF driver's host. No hypervisor, IOMMU, or sandbox boundary is crossed by the corruption itself.\nC:L - When the out-of-bounds pointer slot happens to hold a mapped address, `strncpy()` copies up to 15 bytes of adjacent kernel `.rodata`/heap contents (plus a possible unterminated 16th stack byte) into `cgx_link_user_info.lmac_type`, which is exported to PFs and VFs over the RVU mailbox. The leak is bounded and the source address is not attacker-chosen, so it falls short of arbitrary read.\nI:N - The copy is length-limited to `LMACTYPE_STR_LEN - 1` (15) into a 16-byte destination field, so no out-of-bounds write or control-flow-relevant corruption occurs. Only the read side is out of bounds.\nA:H - Dereferencing the out-of-range/NULL table entry faults in `strncpy` inside the hard-IRQ link-change handler, producing the reported `Internal error: Oops: 96000005` kernel panic. The crash occurs in interrupt context on a core driver path, taking the whole system down." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/marvell/octeontx2/af/cgx.c" ], "versions": [ { "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a", "lessThan": "4392454c694b13d78c84165c0964729772cd3b73", "status": "affected", "versionType": "git" }, { "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a", "lessThan": "83a7f27c5b94e43f29f8216a32790751139aa61e", "status": "affected", "versionType": "git" }, { "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a", "lessThan": "afd7660c766c4d317feae004e5cd829390bbc4b0", "status": "affected", "versionType": "git" }, { "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a", "lessThan": "5c0268b141ad612b6fca13d3a66cfda111716dbb", "status": "affected", "versionType": "git" }, { "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a", "lessThan": "cb5edce271764524b88b1a6866b3e626686d9a33", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/marvell/octeontx2/af/cgx.c" ], "versions": [ { "version": "4.20", "status": "affected" }, { "version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.32", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2.16", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.3", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.259" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.32" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.2.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.3.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4392454c694b13d78c84165c0964729772cd3b73" }, { "url": "https://git.kernel.org/stable/c/83a7f27c5b94e43f29f8216a32790751139aa61e" }, { "url": "https://git.kernel.org/stable/c/afd7660c766c4d317feae004e5cd829390bbc4b0" }, { "url": "https://git.kernel.org/stable/c/5c0268b141ad612b6fca13d3a66cfda111716dbb" }, { "url": "https://git.kernel.org/stable/c/cb5edce271764524b88b1a6866b3e626686d9a33" } ], "title": "octeontx2-af: Add validation for lmac type", "x_generator": { "engine": "bippy-1.2.0" } } } }