CVE-2023-54279
published 2025-12-30CVE-2023-54279: In the Linux kernel, the following vulnerability has been resolved: MIPS: fw: Allow firmware to pass a empty env fw_getenv will use env entry to determine…
PriorityP421medium5.3
EPSS
0.20%
10.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
MIPS: fw: Allow firmware to pass a empty env
fw_getenv will use env entry to determine style of env,
however it is legal for firmware to just pass a empty list.
Check if first entry exist before running strchr to avoid
null pointer dereference.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.37-1 (bookworm) | linux 6.1.37-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 14aecdd419217e041fb5dd2749d11f58503bdf62 < f334b31625683418aaa2a335470eec950a95a254 | f334b31625683418aaa2a335470eec950a95a254 |
| linux | linux | >= 14aecdd419217e041fb5dd2749d11f58503bdf62 < 830181ddced5a05a711dc9da8043203b1f33a77e | 830181ddced5a05a711dc9da8043203b1f33a77e |
| linux | linux | >= 14aecdd419217e041fb5dd2749d11f58503bdf62 < 0f91290774c798199ba4b8df93de5c3156b5163d | 0f91290774c798199ba4b8df93de5c3156b5163d |
| linux | linux | >= 14aecdd419217e041fb5dd2749d11f58503bdf62 < 47e61cadc7a5f3dffd42d2d6fda81be163f1ab82 | 47e61cadc7a5f3dffd42d2d6fda81be163f1ab82 |
| linux | linux | >= 14aecdd419217e041fb5dd2749d11f58503bdf62 < 3ef93b7bd9e042db240843f24a80e14da38c6830 | 3ef93b7bd9e042db240843f24a80e14da38c6830 |
| linux | linux | >= 14aecdd419217e041fb5dd2749d11f58503bdf62 < a6b54af407873227caef6262e992f5422cdcb6ae | a6b54af407873227caef6262e992f5422cdcb6ae |
| linux | linux | >= 14aecdd419217e041fb5dd2749d11f58503bdf62 < ad79828f133e98585ab2236cad04a55eb7141bbe | ad79828f133e98585ab2236cad04a55eb7141bbe |
| linux | linux | >= 14aecdd419217e041fb5dd2749d11f58503bdf62 < aeed787bbbbe1b842beec9a065a36c915226f704 | aeed787bbbbe1b842beec9a065a36c915226f704 |
| linux | linux | >= 14aecdd419217e041fb5dd2749d11f58503bdf62 < ee1809ed7bc456a72dc8410b475b73021a3a68d5 | ee1809ed7bc456a72dc8410b475b73021a3a68d5 |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.37-1 | 6.1.37-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 3.10.0 < 4.14.315 | 4.14.315 |
| linux | linux_kernel | >= 4.15.0 < 4.19.283 | 4.19.283 |
| linux | linux_kernel | >= 4.20.0 < 5.4.243 | 5.4.243 |
| linux | linux_kernel | >= 5.11.0 < 5.15.111 | 5.15.111 |
| linux | linux_kernel | >= 5.16.0 < 6.1.28 | 6.1.28 |
| linux | linux_kernel | >= 5.5.0 < 5.10.180 | 5.10.180 |
| linux | linux_kernel | >= 6.2.0 < 6.2.15 | 6.2.15 |
| linux | linux_kernel | >= 6.3.0 < 6.3.2 | 6.3.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: MIPS: fw: Allow firmware to pass a empty env
vendor_redhat·2025-12-30
CVE-2023-54279 [MEDIUM] kernel: MIPS: fw: Allow firmware to pass a empty env
kernel: MIPS: fw: Allow firmware to pass a empty env
In the Linux kernel, the following vulnerability has been resolved:
MIPS: fw: Allow firmware to pass a empty env
fw_getenv will use env entry to determine style of env,
however it is legal for firmware to just pass a empty list.
Check if first entry exist before running strchr to avoid
null pointer dereference.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red Hat Enterprise Linux 9) - Not affected
Debian
CVE-2023-54279: linux - In the Linux kernel, the following vulnerability has been resolved: MIPS: fw: A...
vendor_debian·2023
CVE-2023-54279 CVE-2023-54279: linux - In the Linux kernel, the following vulnerability has been resolved: MIPS: fw: A...
In the Linux kernel, the following vulnerability has been resolved: MIPS: fw: Allow firmware to pass a empty env fw_getenv will use env entry to determine style of env, however it is legal for firmware to just pass a empty list. Check if first entry exist before running strchr to avoid null pointer dereference.
Scope: local
bookworm: resolved (fixed in 6.1.37-1)
bullseye: resolved (fixed in 5.10.191-1)
forky: resolved (fixed in 6.3.7-1)
sid: resolved (fixed in 6.3.7-1)
trixie: resolved (fixed in 6.3.7-1)
OSV
MIPS: fw: Allow firmware to pass a empty env
osv·2025-12-30
CVE-2023-54279 MIPS: fw: Allow firmware to pass a empty env
MIPS: fw: Allow firmware to pass a empty env
In the Linux kernel, the following vulnerability has been resolved:
MIPS: fw: Allow firmware to pass a empty env
fw_getenv will use env entry to determine style of env,
however it is legal for firmware to just pass a empty list.
Check if first entry exist before running strchr to avoid
null pointer dereference.
GHSA
GHSA-fp2g-4w3c-p2mv: In the Linux kernel, the following vulnerability has been resolved:
MIPS: fw: Allow firmware to pass a empty env
fw_getenv will use env entry to det
ghsa_unreviewed·2025-12-30
CVE-2023-54279 GHSA-fp2g-4w3c-p2mv: In the Linux kernel, the following vulnerability has been resolved:
MIPS: fw: Allow firmware to pass a empty env
fw_getenv will use env entry to det
In the Linux kernel, the following vulnerability has been resolved:
MIPS: fw: Allow firmware to pass a empty env
fw_getenv will use env entry to determine style of env,
however it is legal for firmware to just pass a empty list.
Check if first entry exist before running strchr to avoid
null pointer dereference.
OSV
CVE-2023-54279: In the Linux kernel, the following vulnerability has been resolved: MIPS: fw: Allow firmware to pass a empty env fw_getenv will use env entry to deter
osv·2025-12-30
CVE-2023-54279 CVE-2023-54279: In the Linux kernel, the following vulnerability has been resolved: MIPS: fw: Allow firmware to pass a empty env fw_getenv will use env entry to deter
In the Linux kernel, the following vulnerability has been resolved: MIPS: fw: Allow firmware to pass a empty env fw_getenv will use env entry to determine style of env, however it is legal for firmware to just pass a empty list. Check if first entry exist before running strchr to avoid null pointer dereference.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2023-54279 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2023-54279 [MEDIUM] CVE-2023-54279 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-54279 :
Linux Debian vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
MIPS: fw: Allow firmware to pass a empty env
fw_getenv will use env entry to determine style of env,
however it is legal for firmware to just pass a empty list.
Check if first entry exist before running strchr to avoid
null pointer dereference.
Source : NVD
Published December 30, 2025
CNA Score N/A
Affected Technologies
Linux Debian
Linux Ubuntu
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 15.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
linux
linux-aws-5.15
Sources
NVD
Debian 11, 12, 13, 14 Has Fix Added at: Dec 31,
Bugzilla
CVE-2023-54279 kernel: MIPS: fw: Allow firmware to pass a empty env
bugzilla·2025-12-30
CVE-2023-54279 [MEDIUM] CVE-2023-54279 kernel: MIPS: fw: Allow firmware to pass a empty env
CVE-2023-54279 kernel: MIPS: fw: Allow firmware to pass a empty env
In the Linux kernel, the following vulnerability has been resolved:
MIPS: fw: Allow firmware to pass a empty env
fw_getenv will use env entry to determine style of env,
however it is legal for firmware to just pass a empty list.
Check if first entry exist before running strchr to avoid
null pointer dereference.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025123003-CVE-2023-54279-1dfa@gregkh/T
https://git.kernel.org/stable/c/0f91290774c798199ba4b8df93de5c3156b5163dhttps://git.kernel.org/stable/c/3ef93b7bd9e042db240843f24a80e14da38c6830https://git.kernel.org/stable/c/47e61cadc7a5f3dffd42d2d6fda81be163f1ab82https://git.kernel.org/stable/c/830181ddced5a05a711dc9da8043203b1f33a77ehttps://git.kernel.org/stable/c/a6b54af407873227caef6262e992f5422cdcb6aehttps://git.kernel.org/stable/c/ad79828f133e98585ab2236cad04a55eb7141bbehttps://git.kernel.org/stable/c/aeed787bbbbe1b842beec9a065a36c915226f704https://git.kernel.org/stable/c/ee1809ed7bc456a72dc8410b475b73021a3a68d5https://git.kernel.org/stable/c/f334b31625683418aaa2a335470eec950a95a254
2025-12-30
Published