CVE-2023-54198 — Improper Validation of Specified Index, Position, or Offset in Input in Linux
Severity
3.3LOW
No vectorEPSS
0.0%
top 89.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 30
Description
In the Linux kernel, the following vulnerability has been resolved:
tty: fix out-of-bounds access in tty_driver_lookup_tty()
When specifying an invalid console= device like console=tty3270,
tty_driver_lookup_tty() returns the tty struct without checking
whether index is a valid number.
To reproduce:
qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \
-kernel ../linux-build-x86/arch/x86/boot/bzImage \
-append "console=ttyS0 console=tty3270"
This crashes with:
[ 0.770599] BUG: kern…
Affected Packages4 packages
▶CVEListV5linux/linux99f1fe189daf8e99a847e420567e49dd7ee2aae7 — 3df6f492f500a16c231f07ccc6f6ed1302caddf9+8
🔴Vulnerability Details
3GHSA▶
GHSA-39rg-6496-pf73: In the Linux kernel, the following vulnerability has been resolved:
tty: fix out-of-bounds access in tty_driver_lookup_tty()
When specifying an inva↗2025-12-30
OSV▶
CVE-2023-54198: In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() When specifying an invali↗2025-12-30