In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
When the oob buffer length is not in multiple of words, the oob write function does out-of-bounds read on the oob source buffer at the last iteration. Fix that by always checking length limit on the oob buffer read and fill with 0xff when reaching the end of the buffer to the oob registers.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53541.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53541.json"
[
{
"id": "CVE-2023-53541-2422cac6",
"target": {
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45fe4ad7f439799ee1b7b5f80bf82e8b34a98d25",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274202074113201576735910524120423165998",
"54254759657676976985309841875897164053",
"175064732452116667683215763384233924330",
"83358031149820244208944755133870708519",
"3870467789650512357745456580843805844",
"29310543346339635677950408507066033416",
"239979881114722076363438708712798501225",
"202959715757322143041209368128967544018",
"257412997615816328410807571117539808365",
"249123754657307479627020921632565387808",
"137026904236205140164502041746173233240",
"281188068950659359017132714754139329747",
"48100530183866384585733444377117719848"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53541-4eb84923",
"target": {
"function": "write_oob_to_regs",
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aae45746f4aee9818296e0500e0703e9d8caa5b8",
"digest": {
"function_hash": "303583566986859254633773889331428365253",
"length": 488.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53541-55596844",
"target": {
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d00b031266514a9395124704630b056a5185ec17",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274202074113201576735910524120423165998",
"54254759657676976985309841875897164053",
"175064732452116667683215763384233924330",
"83358031149820244208944755133870708519",
"3870467789650512357745456580843805844",
"29310543346339635677950408507066033416",
"239979881114722076363438708712798501225",
"202959715757322143041209368128967544018",
"257412997615816328410807571117539808365",
"249123754657307479627020921632565387808",
"137026904236205140164502041746173233240",
"281188068950659359017132714754139329747",
"48100530183866384585733444377117719848"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53541-5f5f86d7",
"target": {
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14b1d00520b4d6a4818364334ce472b79cfc8976",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274202074113201576735910524120423165998",
"54254759657676976985309841875897164053",
"175064732452116667683215763384233924330",
"83358031149820244208944755133870708519",
"3870467789650512357745456580843805844",
"29310543346339635677950408507066033416",
"239979881114722076363438708712798501225",
"202959715757322143041209368128967544018",
"257412997615816328410807571117539808365",
"249123754657307479627020921632565387808",
"137026904236205140164502041746173233240",
"281188068950659359017132714754139329747",
"30033798908198819450606969990674828228"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53541-5faa1d46",
"target": {
"function": "write_oob_to_regs",
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d53244186c9ac58cb88d76a0958ca55b83a15cd",
"digest": {
"function_hash": "303583566986859254633773889331428365253",
"length": 488.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53541-89ce2b1e",
"target": {
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aae45746f4aee9818296e0500e0703e9d8caa5b8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274202074113201576735910524120423165998",
"54254759657676976985309841875897164053",
"175064732452116667683215763384233924330",
"83358031149820244208944755133870708519",
"3870467789650512357745456580843805844",
"29310543346339635677950408507066033416",
"239979881114722076363438708712798501225",
"202959715757322143041209368128967544018",
"257412997615816328410807571117539808365",
"249123754657307479627020921632565387808",
"137026904236205140164502041746173233240",
"281188068950659359017132714754139329747",
"30033798908198819450606969990674828228"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53541-9863e26b",
"target": {
"function": "write_oob_to_regs",
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2353b7bb61e45e7cfd21505d0c6747ac8c9496a1",
"digest": {
"function_hash": "303583566986859254633773889331428365253",
"length": 488.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53541-99ebaa8a",
"target": {
"function": "write_oob_to_regs",
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14b1d00520b4d6a4818364334ce472b79cfc8976",
"digest": {
"function_hash": "303583566986859254633773889331428365253",
"length": 488.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53541-a9367f85",
"target": {
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d53244186c9ac58cb88d76a0958ca55b83a15cd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274202074113201576735910524120423165998",
"54254759657676976985309841875897164053",
"175064732452116667683215763384233924330",
"83358031149820244208944755133870708519",
"3870467789650512357745456580843805844",
"29310543346339635677950408507066033416",
"239979881114722076363438708712798501225",
"202959715757322143041209368128967544018",
"257412997615816328410807571117539808365",
"249123754657307479627020921632565387808",
"137026904236205140164502041746173233240",
"281188068950659359017132714754139329747",
"48100530183866384585733444377117719848"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53541-b24d403d",
"target": {
"function": "write_oob_to_regs",
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d00b031266514a9395124704630b056a5185ec17",
"digest": {
"function_hash": "303583566986859254633773889331428365253",
"length": 488.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53541-b26cc355",
"target": {
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2353b7bb61e45e7cfd21505d0c6747ac8c9496a1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274202074113201576735910524120423165998",
"54254759657676976985309841875897164053",
"175064732452116667683215763384233924330",
"83358031149820244208944755133870708519",
"3870467789650512357745456580843805844",
"29310543346339635677950408507066033416",
"239979881114722076363438708712798501225",
"202959715757322143041209368128967544018",
"257412997615816328410807571117539808365",
"249123754657307479627020921632565387808",
"137026904236205140164502041746173233240",
"281188068950659359017132714754139329747",
"48100530183866384585733444377117719848"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53541-bc0e1e60",
"target": {
"file": "drivers/mtd/nand/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bc3d6ac704ea7263175ea3da663fdbbb7f3dd8b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274202074113201576735910524120423165998",
"54254759657676976985309841875897164053",
"175064732452116667683215763384233924330",
"83358031149820244208944755133870708519",
"3870467789650512357745456580843805844",
"29310543346339635677950408507066033416",
"239979881114722076363438708712798501225",
"202959715757322143041209368128967544018",
"257412997615816328410807571117539808365",
"249123754657307479627020921632565387808",
"137026904236205140164502041746173233240",
"281188068950659359017132714754139329747",
"30033798908198819450606969990674828228"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53541-e3b3f199",
"target": {
"function": "write_oob_to_regs",
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@648d1150a688698e37f7aaf302860180901cb30e",
"digest": {
"function_hash": "303583566986859254633773889331428365253",
"length": 488.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53541-e68cf39c",
"target": {
"function": "write_oob_to_regs",
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45fe4ad7f439799ee1b7b5f80bf82e8b34a98d25",
"digest": {
"function_hash": "303583566986859254633773889331428365253",
"length": 488.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53541-ed7a7569",
"target": {
"file": "drivers/mtd/nand/raw/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@648d1150a688698e37f7aaf302860180901cb30e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274202074113201576735910524120423165998",
"54254759657676976985309841875897164053",
"175064732452116667683215763384233924330",
"83358031149820244208944755133870708519",
"3870467789650512357745456580843805844",
"29310543346339635677950408507066033416",
"239979881114722076363438708712798501225",
"202959715757322143041209368128967544018",
"257412997615816328410807571117539808365",
"249123754657307479627020921632565387808",
"137026904236205140164502041746173233240",
"281188068950659359017132714754139329747",
"48100530183866384585733444377117719848"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53541-f6a65903",
"target": {
"function": "write_oob_to_regs",
"file": "drivers/mtd/nand/brcmnand/brcmnand.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bc3d6ac704ea7263175ea3da663fdbbb7f3dd8b",
"digest": {
"function_hash": "303583566986859254633773889331428365253",
"length": 488.0
},
"signature_type": "Function"
}
]