PT-2023-9492 · Linux+2 · Linux Kernel+2

Published 2023-10-06 · Updated 2025-01-13 · CVE-2023-52505

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the phy component of the Linux kernel, specifically with the lynx-28g driver. The problem arises from concurrent calls to phy set mode ext() on lanes sharing the same PCC register, which can lead to corruption of the values programmed to hardware due to the lack of locking in lynx 28g rmw(). This can result in a denial of service. The protocol converter configuration registers PCC8, PCCC, PCCD, and others, control protocol converters from multiple lanes, each represented as a different struct phy. To address this, a spinlock is added to the struct lynx 28g priv shared by all lanes, and the global spinlock is taken from the phy ops :: set mode() implementation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

BDU:2024-07847

CVE-2023-52505

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52505.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2023-52505 · Vendor Advisory
• https://git.kernel.org/stable/c/c2d7c79898b427d263c64a4841987eec131f2d4e · Patch
• https://git.kernel.org/stable/c/6f901f8448c6b25ed843796b114471d2a3fc5dfb · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-52505 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-52505 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-52505 · Security Note
• https://git.kernel.org/stable/c/139ad1143151a07be93bf741d4ea7c89e59f89ce · Patch
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=319139257 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-52505 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52505 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52505 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07847 · Security Note