Vulnerability-Lookup

GHSA-646G-PWV5-GP8F

Vulnerability from github – Published: 2025-12-24 15:30 – Updated: 2026-08-04 12:34

Details

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: Add validation for lmac type

Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac_type based on lmac_type_id received from firmware.

In a few scenarios, firmware returns an invalid lmac_type_id, which is resulting in below kernel panic. This patch adds the missing validation of the lmac_type_id field.

Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 35.321595] Modules linked in: [ 35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted 5.4.210-g2e3169d8e1bc-dirty #17 [ 35.337014] Hardware name: Marvell CN103XX board (DT) [ 35.344297] Workqueue: events work_for_cpu_fn [ 35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO) [ 35.360267] pc : strncpy+0x10/0x30 [ 35.366595] lr : cgx_link_change_handler+0x90/0x180

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-54129"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-24T13:16:14Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Add validation for lmac type\n\nUpon physical link change, firmware reports to the kernel about the\nchange along with the details like speed, lmac_type_id, etc.\nKernel derives lmac_type based on lmac_type_id received from firmware.\n\nIn a few scenarios, firmware returns an invalid lmac_type_id, which\nis resulting in below kernel panic. This patch adds the missing\nvalidation of the lmac_type_id field.\n\nInternal error: Oops: 96000005 [#1] PREEMPT SMP\n[   35.321595] Modules linked in:\n[   35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted\n5.4.210-g2e3169d8e1bc-dirty #17\n[   35.337014] Hardware name: Marvell CN103XX board (DT)\n[   35.344297] Workqueue: events work_for_cpu_fn\n[   35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO)\n[   35.360267] pc : strncpy+0x10/0x30\n[   35.366595] lr : cgx_link_change_handler+0x90/0x180",
  "id": "GHSA-646g-pwv5-gp8f",
  "modified": "2026-08-04T12:34:45Z",
  "published": "2025-12-24T15:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-54129"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4392454c694b13d78c84165c0964729772cd3b73"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5c0268b141ad612b6fca13d3a66cfda111716dbb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/83a7f27c5b94e43f29f8216a32790751139aa61e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/afd7660c766c4d317feae004e5cd829390bbc4b0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cb5edce271764524b88b1a6866b3e626686d9a33"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-54129 (GCVE-0-2023-54129)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:06 – Updated: 2026-08-05 09:17

Title

octeontx2-af: Add validation for lmac type

Summary

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac_type based on lmac_type_id received from firmware. In a few scenarios, firmware returns an invalid lmac_type_id, which is resulting in below kernel panic. This patch adds the missing validation of the lmac_type_id field. Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 35.321595] Modules linked in: [ 35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted 5.4.210-g2e3169d8e1bc-dirty #17 [ 35.337014] Hardware name: Marvell CN103XX board (DT) [ 35.344297] Workqueue: events work_for_cpu_fn [ 35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO) [ 35.360267] pc : strncpy+0x10/0x30 [ 35.366595] lr : cgx_link_change_handler+0x90/0x180

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/4392454c694b13d78…
https://git.kernel.org/stable/c/83a7f27c5b94e43f2…
https://git.kernel.org/stable/c/afd7660c766c4d317…
https://git.kernel.org/stable/c/5c0268b141ad612b6…
https://git.kernel.org/stable/c/cb5edce271764524b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 61071a871ea6eb2125ece91c1a0dbb124a318c8a , < 4392454c694b13d78c84165c0964729772cd3b73 (git) Affected: 61071a871ea6eb2125ece91c1a0dbb124a318c8a , < 83a7f27c5b94e43f29f8216a32790751139aa61e (git) Affected: 61071a871ea6eb2125ece91c1a0dbb124a318c8a , < afd7660c766c4d317feae004e5cd829390bbc4b0 (git) Affected: 61071a871ea6eb2125ece91c1a0dbb124a318c8a , < 5c0268b141ad612b6fca13d3a66cfda111716dbb (git) Affected: 61071a871ea6eb2125ece91c1a0dbb124a318c8a , < cb5edce271764524b88b1a6866b3e626686d9a33 (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 6.1.32 , ≤ 6.1.* (semver) Unaffected: 6.2.16 , ≤ 6.2.* (semver) Unaffected: 6.3.3 , ≤ 6.3.* (semver) Unaffected: 6.4 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/cgx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4392454c694b13d78c84165c0964729772cd3b73",
              "status": "affected",
              "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a",
              "versionType": "git"
            },
            {
              "lessThan": "83a7f27c5b94e43f29f8216a32790751139aa61e",
              "status": "affected",
              "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a",
              "versionType": "git"
            },
            {
              "lessThan": "afd7660c766c4d317feae004e5cd829390bbc4b0",
              "status": "affected",
              "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a",
              "versionType": "git"
            },
            {
              "lessThan": "5c0268b141ad612b6fca13d3a66cfda111716dbb",
              "status": "affected",
              "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a",
              "versionType": "git"
            },
            {
              "lessThan": "cb5edce271764524b88b1a6866b3e626686d9a33",
              "status": "affected",
              "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/cgx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.32",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.16",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Add validation for lmac type\n\nUpon physical link change, firmware reports to the kernel about the\nchange along with the details like speed, lmac_type_id, etc.\nKernel derives lmac_type based on lmac_type_id received from firmware.\n\nIn a few scenarios, firmware returns an invalid lmac_type_id, which\nis resulting in below kernel panic. This patch adds the missing\nvalidation of the lmac_type_id field.\n\nInternal error: Oops: 96000005 [#1] PREEMPT SMP\n[   35.321595] Modules linked in:\n[   35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted\n5.4.210-g2e3169d8e1bc-dirty #17\n[   35.337014] Hardware name: Marvell CN103XX board (DT)\n[   35.344297] Workqueue: events work_for_cpu_fn\n[   35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO)\n[   35.360267] pc : strncpy+0x10/0x30\n[   35.366595] lr : cgx_link_change_handler+0x90/0x180"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable parse runs from the CGX/RPM async link-change interrupt (`cgx_fwi_event_handler` \u2192 `CGX_EVT_ASYNC`/`CGX_EVT_LINK_CHANGE` \u2192 `cgx_link_change_handler`), which fires on physical Ethernet link state and mode transitions on the attached segment. An attacker on the same L2 segment who can flap the link or force renegotiation drives the vulnerable code path without touching the host.\nAC:L - No race, no memory-layout grooming, and no timing window is involved \u2014 every link-change event unconditionally indexes `cgx_lmactype_string[]` with the unvalidated 8-bit firmware field, and the attacker can repeat link transitions indefinitely to hit the reporting scenarios. Choosing Low over High since the trigger is repeatable at will.\nPR:N - The asynchronous link-change notification path requires no authentication, no login, and no host credentials \u2014 it is driven purely by physical link state on the port. The privilege gate `is_cgx_config_permitted()` guards only the mailbox-initiated variant, not the async event path.\nUI:N - The link-change event is processed automatically in the CGX interrupt handler with no administrator or user action required. Nothing needs to be opened, mounted, or configured by a victim.\nS:U - The out-of-bounds read and resulting fault occur entirely within the kernel\u0027s own security authority on the AF driver\u0027s host. No hypervisor, IOMMU, or sandbox boundary is crossed by the corruption itself.\nC:L - When the out-of-bounds pointer slot happens to hold a mapped address, `strncpy()` copies up to 15 bytes of adjacent kernel `.rodata`/heap contents (plus a possible unterminated 16th stack byte) into `cgx_link_user_info.lmac_type`, which is exported to PFs and VFs over the RVU mailbox. The leak is bounded and the source address is not attacker-chosen, so it falls short of arbitrary read.\nI:N - The copy is length-limited to `LMACTYPE_STR_LEN - 1` (15) into a 16-byte destination field, so no out-of-bounds write or control-flow-relevant corruption occurs. Only the read side is out of bounds.\nA:H - Dereferencing the out-of-range/NULL table entry faults in `strncpy` inside the hard-IRQ link-change handler, producing the reported `Internal error: Oops: 96000005` kernel panic. The crash occurs in interrupt context on a core driver path, taking the whole system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:30.008Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4392454c694b13d78c84165c0964729772cd3b73"
        },
        {
          "url": "https://git.kernel.org/stable/c/83a7f27c5b94e43f29f8216a32790751139aa61e"
        },
        {
          "url": "https://git.kernel.org/stable/c/afd7660c766c4d317feae004e5cd829390bbc4b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c0268b141ad612b6fca13d3a66cfda111716dbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb5edce271764524b88b1a6866b3e626686d9a33"
        }
      ],
      "title": "octeontx2-af: Add validation for lmac type",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54129",
    "datePublished": "2025-12-24T13:06:46.817Z",
    "dateReserved": "2025-12-24T13:02:52.521Z",
    "dateUpdated": "2026-08-05T09:17:30.008Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.