CVE-2023-52505
published 2024-03-02CVE-2023-52505: In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers The…
PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.17%
6.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers
The protocol converter configuration registers PCC8, PCCC, PCCD
(implemented by the driver), as well as others, control protocol
converters from multiple lanes (each represented as a different
struct phy). So, if there are simultaneous calls to phy_set_mode_ext()
to lanes sharing the same PCC register (either for the "old" or for the
"new" protocol), corruption of the values programmed to hardware is
possible, because lynx_28g_rmw() has no locking.
Add a spinlock in the struct lynx_28g_priv shared by all lanes, and take
the global spinlock from the phy_ops :: set_mode() implementation. There
are no other callers which modify PCC registers.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 8f73b37cf3fbda67ea1e579c3b5785da4e7aa2e3 < 6f901f8448c6b25ed843796b114471d2a3fc5dfb | 6f901f8448c6b25ed843796b114471d2a3fc5dfb |
| linux | linux | >= 8f73b37cf3fbda67ea1e579c3b5785da4e7aa2e3 < c2d7c79898b427d263c64a4841987eec131f2d4e | c2d7c79898b427d263c64a4841987eec131f2d4e |
| linux | linux | >= 8f73b37cf3fbda67ea1e579c3b5785da4e7aa2e3 < 139ad1143151a07be93bf741d4ea7c89e59f89ce | 139ad1143151a07be93bf741d4ea7c89e59f89ce |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.5.8-1 | 6.5.8-1 |
| linux | linux_kernel | >= 0 < 6.5.8-1 | 6.5.8-1 |
| linux | linux_kernel | >= 5.18 < 6.1.59 | 6.1.59 |
| linux | linux_kernel | >= 6.2 < 6.5.8 | 6.5.8 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mx24-9c8c-52xx: In the Linux kernel, the following vulnerability has been resolved:
phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers
ghsa_unreviewed·2024-03-03
CVE-2023-52505 [MEDIUM] CWE-667 GHSA-mx24-9c8c-52xx: In the Linux kernel, the following vulnerability has been resolved:
phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers
In the Linux kernel, the following vulnerability has been resolved:
phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers
The protocol converter configuration registers PCC8, PCCC, PCCD
(implemented by the driver), as well as others, control protocol
converters from multiple lanes (each represented as a different
struct phy). So, if there are simultaneous calls to phy_set_mode_ext()
to lanes sharing the same PCC register (either for the "old" or for the
"new" protocol), corruption of the values programmed to hardware is
possible, because lynx_28g_rmw() has no locking.
Add a spinlock in the struct lynx_28g_priv shared by all lanes, and take
the global spinlock from the phy_ops :: set_mode() implementation. There
are no other callers which modify PCC registers.
OSV
CVE-2023-52505: In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers T
osv·2024-03-02·CVSS 4.7
CVE-2023-52505 [MEDIUM] CVE-2023-52505: In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers T
In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD (implemented by the driver), as well as others, control protocol converters from multiple lanes (each represented as a different struct phy). So, if there are simultaneous calls to phy_set_mode_ext() to lanes sharing the same PCC register (either for the "old" or for the "new" protocol), corruption of the values programmed to hardware is possible, because lynx_28g_rmw() has no locking. Add a spinlock in the struct lynx_28g_priv shared by all lanes, and take the global spinlock from the phy_ops :: set_mode() implementation. There are no other callers which modify PCC registers.
Red Hat
kernel: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers
vendor_redhat·2024-03-02·CVSS 4.7
CVE-2023-52505 [MEDIUM] CWE-414 kernel: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers
kernel: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers
In the Linux kernel, the following vulnerability has been resolved:
phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers
The protocol converter configuration registers PCC8, PCCC, PCCD
(implemented by the driver), as well as others, control protocol
converters from multiple lanes (each represented as a different
struct phy). So, if there are simultaneous calls to phy_set_mode_ext()
to lanes sharing the same PCC register (either for the "old" or for the
"new" protocol), corruption of the values programmed to hardware is
possible, because lynx_28g_rmw() has no locking.
Add a spinlock in the struct lynx_28g_priv shared by all lanes, and take
the global spinlock from the phy_op
Debian
CVE-2023-52505: linux - In the Linux kernel, the following vulnerability has been resolved: phy: lynx-2...
vendor_debian·2023·CVSS 4.7
CVE-2023-52505 [MEDIUM] CVE-2023-52505: linux - In the Linux kernel, the following vulnerability has been resolved: phy: lynx-2...
In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD (implemented by the driver), as well as others, control protocol converters from multiple lanes (each represented as a different struct phy). So, if there are simultaneous calls to phy_set_mode_ext() to lanes sharing the same PCC register (either for the "old" or for the "new" protocol), corruption of the values programmed to hardware is possible, because lynx_28g_rmw() has no locking. Add a spinlock in the struct lynx_28g_priv shared by all lanes, and take the global spinlock from the phy_ops :: set_mode() implementation. There are no other callers which modify PCC registers.
Sco
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/139ad1143151a07be93bf741d4ea7c89e59f89cehttps://git.kernel.org/stable/c/6f901f8448c6b25ed843796b114471d2a3fc5dfbhttps://git.kernel.org/stable/c/c2d7c79898b427d263c64a4841987eec131f2d4ehttps://git.kernel.org/stable/c/139ad1143151a07be93bf741d4ea7c89e59f89cehttps://git.kernel.org/stable/c/6f901f8448c6b25ed843796b114471d2a3fc5dfbhttps://git.kernel.org/stable/c/c2d7c79898b427d263c64a4841987eec131f2d4e
2024-03-02
Published