cve-2023-52505
Vulnerability from cvelistv5
Published
2024-03-02 21:52
Modified
2024-08-02 23:03
Severity
Summary
phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/139ad1143151a07be93bf741d4ea7c89e59f89ce
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6f901f8448c6b25ed843796b114471d2a3fc5dfb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c2d7c79898b427d263c64a4841987eec131f2d4e
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-11T15:02:00.830027Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:17.026Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:20.376Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6f901f8448c6b25ed843796b114471d2a3fc5dfb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c2d7c79898b427d263c64a4841987eec131f2d4e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/139ad1143151a07be93bf741d4ea7c89e59f89ce"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/freescale/phy-fsl-lynx-28g.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6f901f8448c6",
              "status": "affected",
              "version": "8f73b37cf3fb",
              "versionType": "git"
            },
            {
              "lessThan": "c2d7c79898b4",
              "status": "affected",
              "version": "8f73b37cf3fb",
              "versionType": "git"
            },
            {
              "lessThan": "139ad1143151",
              "status": "affected",
              "version": "8f73b37cf3fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/freescale/phy-fsl-lynx-28g.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.59",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers\n\nThe protocol converter configuration registers PCC8, PCCC, PCCD\n(implemented by the driver), as well as others, control protocol\nconverters from multiple lanes (each represented as a different\nstruct phy). So, if there are simultaneous calls to phy_set_mode_ext()\nto lanes sharing the same PCC register (either for the \"old\" or for the\n\"new\" protocol), corruption of the values programmed to hardware is\npossible, because lynx_28g_rmw() has no locking.\n\nAdd a spinlock in the struct lynx_28g_priv shared by all lanes, and take\nthe global spinlock from the phy_ops :: set_mode() implementation. There\nare no other callers which modify PCC registers."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:13:03.514Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6f901f8448c6b25ed843796b114471d2a3fc5dfb"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2d7c79898b427d263c64a4841987eec131f2d4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/139ad1143151a07be93bf741d4ea7c89e59f89ce"
        }
      ],
      "title": "phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52505",
    "datePublished": "2024-03-02T21:52:19.215Z",
    "dateReserved": "2024-02-20T12:30:33.314Z",
    "dateUpdated": "2024-08-02T23:03:20.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52505\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-02T22:15:47.350\",\"lastModified\":\"2024-03-04T13:58:23.447\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nphy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers\\n\\nThe protocol converter configuration registers PCC8, PCCC, PCCD\\n(implemented by the driver), as well as others, control protocol\\nconverters from multiple lanes (each represented as a different\\nstruct phy). So, if there are simultaneous calls to phy_set_mode_ext()\\nto lanes sharing the same PCC register (either for the \\\"old\\\" or for the\\n\\\"new\\\" protocol), corruption of the values programmed to hardware is\\npossible, because lynx_28g_rmw() has no locking.\\n\\nAdd a spinlock in the struct lynx_28g_priv shared by all lanes, and take\\nthe global spinlock from the phy_ops :: set_mode() implementation. There\\nare no other callers which modify PCC registers.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: phy: lynx-28g: serializa llamadas concurrentes phy_set_mode_ext() a registros compartidos La configuraci\u00f3n del convertidor de protocolo registra PCC8, PCCC, PCCD (implementado por el controlador), as\u00ed como otros, control convertidores de protocolo de m\u00faltiples carriles (cada uno representado como una estructura f\u00edsica diferente). Por lo tanto, si hay llamadas simult\u00e1neas a phy_set_mode_ext() a carriles que comparten el mismo registro PCC (ya sea para el protocolo \\\"antiguo\\\" o para el \\\"nuevo\\\"), es posible que se da\u00f1en los valores programados en el hardware, porque lynx_28g_rmw() no tiene cierre. Agregue un spinlock en la estructura lynx_28g_priv compartida por todos los carriles y tome el spinlock global de la implementaci\u00f3n phy_ops :: set_mode(). No hay otros llamantes que modifiquen los registros PCC.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/139ad1143151a07be93bf741d4ea7c89e59f89ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6f901f8448c6b25ed843796b114471d2a3fc5dfb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c2d7c79898b427d263c64a4841987eec131f2d4e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.