CVE-2023-52655
published 2024-05-14CVE-2023-52655: In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: check packet for fixup for true limit If a device sends a packet that is…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.27%
19.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
usb: aqc111: check packet for fixup for true limit
If a device sends a packet that is inbetween 0
and sizeof(u64) the value passed to skb_trim()
as length will wrap around ending up as some very
large value.
The driver will then proceed to parse the header
located at that position, which will either oops or
process some random value.
The fix is to check against sizeof(u64) rather than
0, which the driver currently does. The issue exists
since the introduction of the driver.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.69-1 (bookworm) | linux 6.1.69-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 361459cd9642631f048719169da9ef14cbf4a932 < 84f2e5b3e70f08fce3cb1ff73414631c5e490204 | 84f2e5b3e70f08fce3cb1ff73414631c5e490204 |
| linux | linux | >= 361459cd9642631f048719169da9ef14cbf4a932 < d69581c17608d81824dd497d9a54b6a5b6139975 | d69581c17608d81824dd497d9a54b6a5b6139975 |
| linux | linux | >= 361459cd9642631f048719169da9ef14cbf4a932 < 46412b2fb1f9cc895d6d4036bf24f640b5d86dab | 46412b2fb1f9cc895d6d4036bf24f640b5d86dab |
| linux | linux | >= 361459cd9642631f048719169da9ef14cbf4a932 < 82c386d73689a45d5ee8c1290827bce64056dddd | 82c386d73689a45d5ee8c1290827bce64056dddd |
| linux | linux | >= 361459cd9642631f048719169da9ef14cbf4a932 < 2ebf775f0541ae0d474836fa0cf3220e502f8e3e | 2ebf775f0541ae0d474836fa0cf3220e502f8e3e |
| linux | linux | >= 361459cd9642631f048719169da9ef14cbf4a932 < ccab434e674ca95d483788b1895a70c21b7f016a | ccab434e674ca95d483788b1895a70c21b7f016a |
| linux | linux_kernel | < 5.4.265 | 5.4.265 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.69-1 | 6.1.69-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 5.11 < 5.15.144 | 5.15.144 |
| linux | linux_kernel | >= 5.16 < 6.1.69 | 6.1.69 |
| linux | linux_kernel | >= 5.5 < 5.10.205 | 5.10.205 |
| linux | linux_kernel | >= 6.2 < 6.6.8 | 6.6.8 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC OS
cisa_ics·2025-08-14
Siemens SINEC OS
ICS Advisory
##
Siemens SINEC OS
Release DateAugust 14, 2025
Alert CodeICSA-25-226-15
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3.1 9.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM, SCALANCE
- Vulnerabilities: NULL Pointer Dereference, Use After Free, Unchecked Input for Loop Condition, Out-of-bounds Write, Ou
Red Hat
kernel: usb: aqc111: check packet for fixup for true limit
vendor_redhat·2024-05-13·CVSS 5.5
CVE-2023-52655 [MEDIUM] CWE-467 kernel: usb: aqc111: check packet for fixup for true limit
kernel: usb: aqc111: check packet for fixup for true limit
In the Linux kernel, the following vulnerability has been resolved:
usb: aqc111: check packet for fixup for true limit
If a device sends a packet that is inbetween 0
and sizeof(u64) the value passed to skb_trim()
as length will wrap around ending up as some very
large value.
The driver will then proceed to parse the header
located at that position, which will either oops or
process some random value.
The fix is to check against sizeof(u64) rather than
0, which the driver currently does. The issue exists
since the introduction of the driver.
A vulnerability was found in the Linux kernel's `usb: aqc111` driver. The issue involves inadequate packet handling, which could lead to incorrect limit enforcement.
Statement: Red Hat Enterp
Debian
CVE-2023-52655: linux - In the Linux kernel, the following vulnerability has been resolved: usb: aqc111...
vendor_debian·2023·CVSS 5.5
CVE-2023-52655 [MEDIUM] CVE-2023-52655: linux - In the Linux kernel, the following vulnerability has been resolved: usb: aqc111...
In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: check packet for fixup for true limit If a device sends a packet that is inbetween 0 and sizeof(u64) the value passed to skb_trim() as length will wrap around ending up as some very large value. The driver will then proceed to parse the header located at that position, which will either oops or process some random value. The fix is to check against sizeof(u64) rather than 0, which the driver currently does. The issue exists since the introduction of the driver.
Scope: local
bookworm: resolved (fixed in 6.1.69-1)
bullseye: resolved (fixed in 5.10.205-1)
forky: resolved (fixed in 6.6.8-1)
sid: resolved (fixed in 6.6.8-1)
trixie: resolved (fixed in 6.6.8-1)
OSV
CVE-2023-52655: In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: check packet for fixup for true limit If a device sends a packet that
osv·2024-05-14·CVSS 5.5
CVE-2023-52655 [MEDIUM] CVE-2023-52655: In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: check packet for fixup for true limit If a device sends a packet that
In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: check packet for fixup for true limit If a device sends a packet that is inbetween 0 and sizeof(u64) the value passed to skb_trim() as length will wrap around ending up as some very large value. The driver will then proceed to parse the header located at that position, which will either oops or process some random value. The fix is to check against sizeof(u64) rather than 0, which the driver currently does. The issue exists since the introduction of the driver.
GHSA
GHSA-mvg2-4m23-mpp3: In the Linux kernel, the following vulnerability has been resolved:
usb: aqc111: check packet for fixup for true limit
If a device sends a packet th
ghsa_unreviewed·2024-05-14
CVE-2023-52655 [MEDIUM] GHSA-mvg2-4m23-mpp3: In the Linux kernel, the following vulnerability has been resolved:
usb: aqc111: check packet for fixup for true limit
If a device sends a packet th
In the Linux kernel, the following vulnerability has been resolved:
usb: aqc111: check packet for fixup for true limit
If a device sends a packet that is inbetween 0
and sizeof(u64) the value passed to skb_trim()
as length will wrap around ending up as some very
large value.
The driver will then proceed to parse the header
located at that position, which will either oops or
process some random value.
The fix is to check against sizeof(u64) rather than
0, which the driver currently does. The issue exists
since the introduction of the driver.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2ebf775f0541ae0d474836fa0cf3220e502f8e3ehttps://git.kernel.org/stable/c/46412b2fb1f9cc895d6d4036bf24f640b5d86dabhttps://git.kernel.org/stable/c/82c386d73689a45d5ee8c1290827bce64056ddddhttps://git.kernel.org/stable/c/84f2e5b3e70f08fce3cb1ff73414631c5e490204https://git.kernel.org/stable/c/ccab434e674ca95d483788b1895a70c21b7f016ahttps://git.kernel.org/stable/c/d69581c17608d81824dd497d9a54b6a5b6139975https://git.kernel.org/stable/c/2ebf775f0541ae0d474836fa0cf3220e502f8e3ehttps://git.kernel.org/stable/c/46412b2fb1f9cc895d6d4036bf24f640b5d86dabhttps://git.kernel.org/stable/c/82c386d73689a45d5ee8c1290827bce64056ddddhttps://git.kernel.org/stable/c/84f2e5b3e70f08fce3cb1ff73414631c5e490204https://git.kernel.org/stable/c/ccab434e674ca95d483788b1895a70c21b7f016ahttps://git.kernel.org/stable/c/d69581c17608d81824dd497d9a54b6a5b6139975
2024-05-14
Published