GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54129 (GCVE-0-2023-54129)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:06 – Updated: 2026-08-05 09:17
VLAI
Title
octeontx2-af: Add validation for lmac type
Summary
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac_type based on lmac_type_id received from firmware. In a few scenarios, firmware returns an invalid lmac_type_id, which is resulting in below kernel panic. This patch adds the missing validation of the lmac_type_id field. Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 35.321595] Modules linked in: [ 35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted 5.4.210-g2e3169d8e1bc-dirty #17 [ 35.337014] Hardware name: Marvell CN103XX board (DT) [ 35.344297] Workqueue: events work_for_cpu_fn [ 35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO) [ 35.360267] pc : strncpy+0x10/0x30 [ 35.366595] lr : cgx_link_change_handler+0x90/0x180
Severity
7.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 61071a871ea6eb2125ece91c1a0dbb124a318c8a , < 4392454c694b13d78c84165c0964729772cd3b73 (git)
Affected: 61071a871ea6eb2125ece91c1a0dbb124a318c8a , < 83a7f27c5b94e43f29f8216a32790751139aa61e (git)
Affected: 61071a871ea6eb2125ece91c1a0dbb124a318c8a , < afd7660c766c4d317feae004e5cd829390bbc4b0 (git)
Affected: 61071a871ea6eb2125ece91c1a0dbb124a318c8a , < 5c0268b141ad612b6fca13d3a66cfda111716dbb (git)
Affected: 61071a871ea6eb2125ece91c1a0dbb124a318c8a , < cb5edce271764524b88b1a6866b3e626686d9a33 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 6.1.32 , ≤ 6.1.* (semver)
Unaffected: 6.2.16 , ≤ 6.2.* (semver)
Unaffected: 6.3.3 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/cgx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4392454c694b13d78c84165c0964729772cd3b73",
              "status": "affected",
              "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a",
              "versionType": "git"
            },
            {
              "lessThan": "83a7f27c5b94e43f29f8216a32790751139aa61e",
              "status": "affected",
              "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a",
              "versionType": "git"
            },
            {
              "lessThan": "afd7660c766c4d317feae004e5cd829390bbc4b0",
              "status": "affected",
              "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a",
              "versionType": "git"
            },
            {
              "lessThan": "5c0268b141ad612b6fca13d3a66cfda111716dbb",
              "status": "affected",
              "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a",
              "versionType": "git"
            },
            {
              "lessThan": "cb5edce271764524b88b1a6866b3e626686d9a33",
              "status": "affected",
              "version": "61071a871ea6eb2125ece91c1a0dbb124a318c8a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/cgx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.32",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.16",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Add validation for lmac type\n\nUpon physical link change, firmware reports to the kernel about the\nchange along with the details like speed, lmac_type_id, etc.\nKernel derives lmac_type based on lmac_type_id received from firmware.\n\nIn a few scenarios, firmware returns an invalid lmac_type_id, which\nis resulting in below kernel panic. This patch adds the missing\nvalidation of the lmac_type_id field.\n\nInternal error: Oops: 96000005 [#1] PREEMPT SMP\n[   35.321595] Modules linked in:\n[   35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted\n5.4.210-g2e3169d8e1bc-dirty #17\n[   35.337014] Hardware name: Marvell CN103XX board (DT)\n[   35.344297] Workqueue: events work_for_cpu_fn\n[   35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO)\n[   35.360267] pc : strncpy+0x10/0x30\n[   35.366595] lr : cgx_link_change_handler+0x90/0x180"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable parse runs from the CGX/RPM async link-change interrupt (`cgx_fwi_event_handler` \u2192 `CGX_EVT_ASYNC`/`CGX_EVT_LINK_CHANGE` \u2192 `cgx_link_change_handler`), which fires on physical Ethernet link state and mode transitions on the attached segment. An attacker on the same L2 segment who can flap the link or force renegotiation drives the vulnerable code path without touching the host.\nAC:L - No race, no memory-layout grooming, and no timing window is involved \u2014 every link-change event unconditionally indexes `cgx_lmactype_string[]` with the unvalidated 8-bit firmware field, and the attacker can repeat link transitions indefinitely to hit the reporting scenarios. Choosing Low over High since the trigger is repeatable at will.\nPR:N - The asynchronous link-change notification path requires no authentication, no login, and no host credentials \u2014 it is driven purely by physical link state on the port. The privilege gate `is_cgx_config_permitted()` guards only the mailbox-initiated variant, not the async event path.\nUI:N - The link-change event is processed automatically in the CGX interrupt handler with no administrator or user action required. Nothing needs to be opened, mounted, or configured by a victim.\nS:U - The out-of-bounds read and resulting fault occur entirely within the kernel\u0027s own security authority on the AF driver\u0027s host. No hypervisor, IOMMU, or sandbox boundary is crossed by the corruption itself.\nC:L - When the out-of-bounds pointer slot happens to hold a mapped address, `strncpy()` copies up to 15 bytes of adjacent kernel `.rodata`/heap contents (plus a possible unterminated 16th stack byte) into `cgx_link_user_info.lmac_type`, which is exported to PFs and VFs over the RVU mailbox. The leak is bounded and the source address is not attacker-chosen, so it falls short of arbitrary read.\nI:N - The copy is length-limited to `LMACTYPE_STR_LEN - 1` (15) into a 16-byte destination field, so no out-of-bounds write or control-flow-relevant corruption occurs. Only the read side is out of bounds.\nA:H - Dereferencing the out-of-range/NULL table entry faults in `strncpy` inside the hard-IRQ link-change handler, producing the reported `Internal error: Oops: 96000005` kernel panic. The crash occurs in interrupt context on a core driver path, taking the whole system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:30.008Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4392454c694b13d78c84165c0964729772cd3b73"
        },
        {
          "url": "https://git.kernel.org/stable/c/83a7f27c5b94e43f29f8216a32790751139aa61e"
        },
        {
          "url": "https://git.kernel.org/stable/c/afd7660c766c4d317feae004e5cd829390bbc4b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c0268b141ad612b6fca13d3a66cfda111716dbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb5edce271764524b88b1a6866b3e626686d9a33"
        }
      ],
      "title": "octeontx2-af: Add validation for lmac type",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54129",
    "datePublished": "2025-12-24T13:06:46.817Z",
    "dateReserved": "2025-12-24T13:02:52.521Z",
    "dateUpdated": "2026-08-05T09:17:30.008Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54129",
      "date": "2026-09-13",
      "epss": "0.00286",
      "percentile": "0.21054"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54129\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:14.887\",\"lastModified\":\"2026-08-04T10:19:30.620\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocteontx2-af: Add validation for lmac type\\n\\nUpon physical link change, firmware reports to the kernel about the\\nchange along with the details like speed, lmac_type_id, etc.\\nKernel derives lmac_type based on lmac_type_id received from firmware.\\n\\nIn a few scenarios, firmware returns an invalid lmac_type_id, which\\nis resulting in below kernel panic. This patch adds the missing\\nvalidation of the lmac_type_id field.\\n\\nInternal error: Oops: 96000005 [#1] PREEMPT SMP\\n[   35.321595] Modules linked in:\\n[   35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted\\n5.4.210-g2e3169d8e1bc-dirty #17\\n[   35.337014] Hardware name: Marvell CN103XX board (DT)\\n[   35.344297] Workqueue: events work_for_cpu_fn\\n[   35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO)\\n[   35.360267] pc : strncpy+0x10/0x30\\n[   35.366595] lr : cgx_link_change_handler+0x90/0x180\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/marvell/octeontx2/af/cgx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"61071a871ea6eb2125ece91c1a0dbb124a318c8a\",\"lessThan\":\"4392454c694b13d78c84165c0964729772cd3b73\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61071a871ea6eb2125ece91c1a0dbb124a318c8a\",\"lessThan\":\"83a7f27c5b94e43f29f8216a32790751139aa61e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61071a871ea6eb2125ece91c1a0dbb124a318c8a\",\"lessThan\":\"afd7660c766c4d317feae004e5cd829390bbc4b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61071a871ea6eb2125ece91c1a0dbb124a318c8a\",\"lessThan\":\"5c0268b141ad612b6fca13d3a66cfda111716dbb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61071a871ea6eb2125ece91c1a0dbb124a318c8a\",\"lessThan\":\"cb5edce271764524b88b1a6866b3e626686d9a33\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/marvell/octeontx2/af/cgx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.32\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.16\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.3\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4392454c694b13d78c84165c0964729772cd3b73\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5c0268b141ad612b6fca13d3a66cfda111716dbb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/83a7f27c5b94e43f29f8216a32790751139aa61e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/afd7660c766c4d317feae004e5cd829390bbc4b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cb5edce271764524b88b1a6866b3e626686d9a33\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-14T18:43:34+00:00",
      "cve": "CVE-2023-54129",
      "id": "CVE-2023-54129",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: octeontx2-af: Add validation for lmac type",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54129.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:41:12Z",
      "cve": "CVE-2023-54129",
      "id": "CVE-2023-54129",
      "initial_release_date": "2025-12-25T00:54:57Z",
      "product_status:known_affected": "201",
      "product_status:known_not_affected": "359",
      "product_status:recommended": "29",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54129",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54129.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.