Kernel Crash Vulnerability in Linux Package: imx8mm-verdin Ethernet PHY Power Management Issue
Summary
CVE-2023-52985: In the Linux kernel, the following vulnerability has been resolved: arm64: dts: imx8mm-verdin: Do not power down eth-phy Currently if suspending using either freeze or memory state, the fec driver tries to power down the... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system operations. The imx8mm-verdin is a specific hardware platform that utilizes the Linux kernel to manage its functionalities, including network operations through the Ethernet PHY. This platform is designed for embedded systems, offering features such as low power consumption and high performance. However, it is vulnerable to a specific issue where the Ethernet PHY power management can lead to kernel crashes during suspend operations.
Vulnerability Detail
The vulnerability arises from the Ethernet controller driver (fec driver) attempting to power down the Ethernet PHY during system suspend states (freeze or memory). This action leads to kernel crashes and an unresponsive system, as indicated by the call trace logs. The lack of functionality in the PHY subsystem to properly manage power down operations exacerbates the issue, making it critical for users of the affected Linux versions to address this vulnerability promptly.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no official workaround for this vulnerability other than updating to the patched version. Users should refrain from using suspend states that trigger the power down of the Ethernet PHY until the update is applied.
Conclusion
The CVE-2023-52985 vulnerability in the Linux kernel poses a significant risk to systems using the imx8mm-verdin platform due to improper Ethernet PHY power management. Users are strongly advised to update to the patched version 6.1.11-1 to prevent kernel crashes and ensure system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2023-52985 is a vulnerability in the Linux kernel related to the improper handling of Ethernet PHY power management during system suspend, leading to kernel crashes.
The vulnerability affects Linux versions prior to 6.1.11-1 in Debian 12 and 13.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If exploited, this vulnerability can cause the kernel to crash, resulting in an unresponsive system and potential data loss.
The best mitigation is to avoid using suspend states that trigger the power down of the Ethernet PHY until the system is updated to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
