Buffer Overflow Vulnerability in Linux Kernel's ice_get_module_eeprom Function
Summary
CVE-2023-53142: In the Linux kernel, the following vulnerability has been resolved: ice: copy last block omitted in ice_get_module_eeprom() ice_get_module_eeprom() is broken since commit e9c9692c8a81 ("ice: Reimplement module reads used... Affects linux versions < 6.1.20-1. Fixed in 6.1.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. The 'ice' driver is responsible for managing Intel Ethernet devices, enabling efficient network communication. This vulnerability affects the 'ice_get_module_eeprom' function, which is designed to read EEPROM data from network modules. The issue arises from a flaw in how the function handles data blocks, leading to potential buffer overflow scenarios.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the 'ice_get_module_eeprom' function, which was introduced in commit e9c9692c8a81. The function reads EEPROM data in blocks of size 8 but fails to account for the last block, which can lead to a buffer overflow. This oversight can result in unintended behavior or crashes when the function is called with certain parameters. The bug was highlighted by an upstream commit to ethtool that changed how EEPROM data is requested, exposing the flaw in the original implementation.
How To Fix
Minimum fixed version
6.1.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
The CVE-2023-53142 vulnerability in the Linux kernel's ice driver poses a significant risk due to improper handling of EEPROM data, leading to potential buffer overflow issues. Users are advised to update their systems to the patched version to ensure security and stability.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53142 is a vulnerability in the Linux kernel's ice driver that can lead to buffer overflow due to improper handling of EEPROM data.
Exploiting this vulnerability could lead to crashes or unintended behavior in network communication, potentially compromising system stability.
If you are using a version of the Linux kernel prior to 6.1.20-1, your system may be vulnerable. You can check your kernel version using the command 'uname -r'.
You can update your Linux kernel on Debian-based systems using the command 'sudo apt-get update && sudo apt-get install linux'.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
