CVE-2023-53535 (GCVE-0-2023-53535)
Vulnerability from cvelistv5
Published
2025-10-04 15:16
Modified
2026-10-15 21:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: Add a check for oversized packets
Occasionnaly we may get oversized packets from the hardware which
exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early
check which drops the packet to avoid invoking skb_over_panic() and move
on to processing the next packet.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1c1008c793fa46703a2fee469f4235e1c7984333 Version: 1c1008c793fa46703a2fee469f4235e1c7984333 Version: 1c1008c793fa46703a2fee469f4235e1c7984333 Version: 1c1008c793fa46703a2fee469f4235e1c7984333 Version: 1c1008c793fa46703a2fee469f4235e1c7984333 Version: 1c1008c793fa46703a2fee469f4235e1c7984333 Version: 1c1008c793fa46703a2fee469f4235e1c7984333 Version: 1c1008c793fa46703a2fee469f4235e1c7984333 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-53535",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T21:35:28.502360Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:41:30.176Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7cdb07e10c1258c08f31b24898930e4ece88d163",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "c34b1c0870323649d45c5074828d7f754dea2673",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "87363d1ab55e497702a9506ff423c422639c8a25",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "841881320562cbeac7046b537b91cd000480cea2",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "124ca24e0de958d2e20e0aa1e2434af7b72f8887",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "5f56767fb5f2df875b6553e08dbec6a45431c988",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "411317d2a4a7d6049d8efeef0d32ae43f8baefce",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "5c0862c2c962052ed5055220a00ac1cefb92fbcd",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.308",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.276",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.235",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.308",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.276",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.235",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.173",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.99",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: Add a check for oversized packets\n\nOccasionnaly we may get oversized packets from the hardware which\nexceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early\ncheck which drops the packet to avoid invoking skb_over_panic() and move\non to processing the next packet."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable code is the bcmgenet RX descriptor path executed on every Ethernet/MoCA frame the MAC delivers, so the attacker only needs to inject traffic onto the same L2 segment as the Raspberry Pi 4/CM4 or Broadcom set-top box. An RX buffer length above 2048 requires a link-layer framing/oversize condition that cannot survive routing (UMAC_MAX_FRAME_LEN is 1536 and path MTU caps routed frames), so this is adjacent rather than fully remote.\nAC:L - The attacker fully controls the volume, size and framing of the traffic hitting the MAC and can retry indefinitely at line rate at zero cost; there is no race to win, no memory layout to groom, and no target state the attacker cannot influence. Repeatable free retries against a condition the maintainer describes as occurring during normal reception make this Low.\nPR:N - No account, credential, or capability on the target is needed \u2014 bcmgenet_desc_rx() runs in NAPI softirq context on received frames long before any authentication, filtering, or socket-layer authorization is consulted. Any host on the shared Ethernet/coax segment can reach it.\nUI:N - No victim action is required; the interface merely has to be up and receiving, which is its normal operating state. The vulnerable skb_put() executes automatically for every descriptor processed.\nS:U - The panic and the stale-memory read both occur in the host kernel\u0027s own security authority, with no VM, hypervisor, IOMMU, or sandbox boundary crossed. Standard kernel-local impact.\nC:L - For len values between the 2048-byte DMA region and the 2112-byte SKB tailroom, skb_put() succeeds and hands up to 64 bytes of stale per-CPU page_frag memory (leftovers of previously received packets) to the network stack, where a bridging/forwarding deployment can transmit it back onto the wire. The read is hard-capped by skb-\u003eend and the IP stack trims it in most paths, so the disclosure is real but strictly bounded.\nI:N - The RDMA ring\u0027s DMA_RING_BUF_SIZE is programmed with RX_BUF_LENGTH, so the hardware never writes past the 2048-byte mapping \u2014 the bug is a bogus length report, not an out-of-bounds write. No kernel memory is corrupted and no control-flow or data-write primitive is obtained.\nA:H - Any reported length above 2112 drives skb_put() into skb_over_panic(), which calls BUG() from softirq context, taking the machine down immediately (the unmasked 16-bit shift permits lengths up to 65535, far past the limit). This is a full denial of service reachable from the network with no credentials."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:14:39.345Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7cdb07e10c1258c08f31b24898930e4ece88d163"
},
{
"url": "https://git.kernel.org/stable/c/c34b1c0870323649d45c5074828d7f754dea2673"
},
{
"url": "https://git.kernel.org/stable/c/87363d1ab55e497702a9506ff423c422639c8a25"
},
{
"url": "https://git.kernel.org/stable/c/841881320562cbeac7046b537b91cd000480cea2"
},
{
"url": "https://git.kernel.org/stable/c/124ca24e0de958d2e20e0aa1e2434af7b72f8887"
},
{
"url": "https://git.kernel.org/stable/c/5f56767fb5f2df875b6553e08dbec6a45431c988"
},
{
"url": "https://git.kernel.org/stable/c/411317d2a4a7d6049d8efeef0d32ae43f8baefce"
},
{
"url": "https://git.kernel.org/stable/c/5c0862c2c962052ed5055220a00ac1cefb92fbcd"
}
],
"title": "net: bcmgenet: Add a check for oversized packets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53535",
"datePublished": "2025-10-04T15:16:46.583Z",
"dateReserved": "2025-10-04T15:14:15.919Z",
"dateUpdated": "2026-10-15T21:41:30.176Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-53535\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-15T21:35:28.502360Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-15T21:35:29.320Z\"}}], \"cna\": {\"title\": \"net: bcmgenet: Add a check for oversized packets\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The vulnerable code is the bcmgenet RX descriptor path executed on every Ethernet/MoCA frame the MAC delivers, so the attacker only needs to inject traffic onto the same L2 segment as the Raspberry Pi 4/CM4 or Broadcom set-top box. An RX buffer length above 2048 requires a link-layer framing/oversize condition that cannot survive routing (UMAC_MAX_FRAME_LEN is 1536 and path MTU caps routed frames), so this is adjacent rather than fully remote.\\nAC:L - The attacker fully controls the volume, size and framing of the traffic hitting the MAC and can retry indefinitely at line rate at zero cost; there is no race to win, no memory layout to groom, and no target state the attacker cannot influence. Repeatable free retries against a condition the maintainer describes as occurring during normal reception make this Low.\\nPR:N - No account, credential, or capability on the target is needed \\u2014 bcmgenet_desc_rx() runs in NAPI softirq context on received frames long before any authentication, filtering, or socket-layer authorization is consulted. Any host on the shared Ethernet/coax segment can reach it.\\nUI:N - No victim action is required; the interface merely has to be up and receiving, which is its normal operating state. The vulnerable skb_put() executes automatically for every descriptor processed.\\nS:U - The panic and the stale-memory read both occur in the host kernel\u0027s own security authority, with no VM, hypervisor, IOMMU, or sandbox boundary crossed. Standard kernel-local impact.\\nC:L - For len values between the 2048-byte DMA region and the 2112-byte SKB tailroom, skb_put() succeeds and hands up to 64 bytes of stale per-CPU page_frag memory (leftovers of previously received packets) to the network stack, where a bridging/forwarding deployment can transmit it back onto the wire. The read is hard-capped by skb-\u003eend and the IP stack trims it in most paths, so the disclosure is real but strictly bounded.\\nI:N - The RDMA ring\u0027s DMA_RING_BUF_SIZE is programmed with RX_BUF_LENGTH, so the hardware never writes past the 2048-byte mapping \\u2014 the bug is a bogus length report, not an out-of-bounds write. No kernel memory is corrupted and no control-flow or data-write primitive is obtained.\\nA:H - Any reported length above 2112 drives skb_put() into skb_over_panic(), which calls BUG() from softirq context, taking the machine down immediately (the unmasked 16-bit shift permits lengths up to 65535, far past the limit). This is a full denial of service reachable from the network with no credentials.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1c1008c793fa46703a2fee469f4235e1c7984333\", \"lessThan\": \"7cdb07e10c1258c08f31b24898930e4ece88d163\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1c1008c793fa46703a2fee469f4235e1c7984333\", \"lessThan\": \"c34b1c0870323649d45c5074828d7f754dea2673\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1c1008c793fa46703a2fee469f4235e1c7984333\", \"lessThan\": \"87363d1ab55e497702a9506ff423c422639c8a25\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1c1008c793fa46703a2fee469f4235e1c7984333\", \"lessThan\": \"841881320562cbeac7046b537b91cd000480cea2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1c1008c793fa46703a2fee469f4235e1c7984333\", \"lessThan\": \"124ca24e0de958d2e20e0aa1e2434af7b72f8887\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1c1008c793fa46703a2fee469f4235e1c7984333\", \"lessThan\": \"5f56767fb5f2df875b6553e08dbec6a45431c988\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1c1008c793fa46703a2fee469f4235e1c7984333\", \"lessThan\": \"411317d2a4a7d6049d8efeef0d32ae43f8baefce\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1c1008c793fa46703a2fee469f4235e1c7984333\", \"lessThan\": \"5c0862c2c962052ed5055220a00ac1cefb92fbcd\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/genet/bcmgenet.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.308\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.276\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.235\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.173\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.99\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.2.*\"}, {\"status\": \"unaffected\", \"version\": \"6.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/genet/bcmgenet.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7cdb07e10c1258c08f31b24898930e4ece88d163\"}, {\"url\": \"https://git.kernel.org/stable/c/c34b1c0870323649d45c5074828d7f754dea2673\"}, {\"url\": \"https://git.kernel.org/stable/c/87363d1ab55e497702a9506ff423c422639c8a25\"}, {\"url\": \"https://git.kernel.org/stable/c/841881320562cbeac7046b537b91cd000480cea2\"}, {\"url\": \"https://git.kernel.org/stable/c/124ca24e0de958d2e20e0aa1e2434af7b72f8887\"}, {\"url\": \"https://git.kernel.org/stable/c/5f56767fb5f2df875b6553e08dbec6a45431c988\"}, {\"url\": \"https://git.kernel.org/stable/c/411317d2a4a7d6049d8efeef0d32ae43f8baefce\"}, {\"url\": \"https://git.kernel.org/stable/c/5c0862c2c962052ed5055220a00ac1cefb92fbcd\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: bcmgenet: Add a check for oversized packets\\n\\nOccasionnaly we may get oversized packets from the hardware which\\nexceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early\\ncheck which drops the packet to avoid invoking skb_over_panic() and move\\non to processing the next packet.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.308\", \"versionStartIncluding\": \"3.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.276\", \"versionStartIncluding\": \"3.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.235\", \"versionStartIncluding\": \"3.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.173\", \"versionStartIncluding\": \"3.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.99\", \"versionStartIncluding\": \"3.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.16\", \"versionStartIncluding\": \"3.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2.3\", \"versionStartIncluding\": \"3.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.3\", \"versionStartIncluding\": \"3.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:14:39.345Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-53535\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-15T21:41:30.176Z\", \"dateReserved\": \"2025-10-04T15:14:15.919Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-10-04T15:16:46.583Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…