CVE-2023-54065 (GCVE-0-2023-54065)

Vulnerability from cvelistv5 – Published: 2025-12-24 12:23 – Updated: 2026-08-05 09:16
VLAI
Title
net: dsa: realtek: fix out-of-bounds access
Summary
In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: fix out-of-bounds access The probe function sets priv->chip_data to (void *)priv + sizeof(*priv) with the expectation that priv has enough trailing space. However, only realtek-smi actually allocated this chip_data space. Do likewise in realtek-mdio to fix out-of-bounds accesses. These accesses likely went unnoticed so far, because of an (unused) buf[4096] member in struct realtek_priv, which caused kmalloc to round up the allocated buffer to a big enough size, so nothing of value was overwritten. With a different allocator (like in the barebox bootloader port of the driver) or with KASAN, the memory corruption becomes quickly apparent.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aac94001067da183455d6d37959892744fa01d9d , < cc0f9bb99735d2b68fac68f37b585d615728ce5b (git)
Affected: aac94001067da183455d6d37959892744fa01d9d , < fe668aa499b4b95425044ba11af9609db6ecf466 (git)
Affected: aac94001067da183455d6d37959892744fa01d9d , < b93eb564869321d0dffaf23fcc5c88112ed62466 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.23 , ≤ 6.1.* (semver)
Unaffected: 6.2.10 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/realtek/realtek-mdio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc0f9bb99735d2b68fac68f37b585d615728ce5b",
              "status": "affected",
              "version": "aac94001067da183455d6d37959892744fa01d9d",
              "versionType": "git"
            },
            {
              "lessThan": "fe668aa499b4b95425044ba11af9609db6ecf466",
              "status": "affected",
              "version": "aac94001067da183455d6d37959892744fa01d9d",
              "versionType": "git"
            },
            {
              "lessThan": "b93eb564869321d0dffaf23fcc5c88112ed62466",
              "status": "affected",
              "version": "aac94001067da183455d6d37959892744fa01d9d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/realtek/realtek-mdio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.23",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.10",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: realtek: fix out-of-bounds access\n\nThe probe function sets priv-\u003echip_data to (void *)priv + sizeof(*priv)\nwith the expectation that priv has enough trailing space.\n\nHowever, only realtek-smi actually allocated this chip_data space.\nDo likewise in realtek-mdio to fix out-of-bounds accesses.\n\nThese accesses likely went unnoticed so far, because of an (unused)\nbuf[4096] member in struct realtek_priv, which caused kmalloc to\nround up the allocated buffer to a big enough size, so nothing of\nvalue was overwritten. With a different allocator (like in the barebox\nbootloader port of the driver) or with KASAN, the memory corruption\nbecomes quickly apparent."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is in a DSA switch driver probe path bound via device tree, and the reachable trigger surfaces are local \u2014 driver probe at boot, `ip -s link`/sysfs stat reads, and `ip link set mtu`/VLAN configuration on the DSA slave ports. No received network frame or remote peer data reaches the miscalculated `chip_data` pointer, so neither Network nor Adjacent applies.\nAC:L - The miscalculation is unconditional: every single probe of `realtek-mdio` sets `chip_data` past the end of the allocation, and every subsequent access is out of bounds with no race, timing window, or memory-layout precondition. Reading the leaked stale heap back out requires only an unprivileged `ip -s link`, and the affected chips (RTL8366RB, RTL8365MB-VC, RTL8367S) are mainstream in shipped router/embedded kernels, not a rare configuration.\nPR:L - The out-of-bounds writes occur automatically during boot-time probe with no attacker involvement at all, and the resulting kernel-heap disclosure is harvested through `ndo_get_stats64` counters that any unprivileged local process can read from `/sys/class/net/*/statistics/*` with no `capable()` check anywhere on the path. Only the additional MTU/VLAN write primitives need `CAP_NET_ADMIN`, so a basic unprivileged user is the correct floor.\nUI:N - No victim action is required \u2014 the corruption is established by the driver itself at probe and the periodic `mib_work` poller keeps touching the out-of-bounds region on its own. The attacker\u0027s own process reads the leaked bytes back with no interaction from any other user.\nS:U - The miscalculated pointer, the corrupted slab memory, and the impacted component are all the same kernel image and the same security authority. There is no guest-to-host escape, IOMMU bypass, or sandbox boundary crossed.\nC:H - `rtl8365mb_get_stats64()` memcpy\u0027s 192 bytes per port (11 ports) out of the never-zeroed tail of the slab object \u2014 stale data recycled from a previously freed allocation \u2014 directly into netdev statistics that any unprivileged user can read, an unbounded-content kernel heap disclosure that works on every configuration. All the other `chip_data` reads (`mb-\u003echip_info`, `rb-\u003emax_mtu[]`, `rb-\u003epvid_enabled[]`) are likewise out-of-bounds reads of adjacent memory.\nI:H - This is an out-of-bounds write, which is High by definition: probe writes an entire `struct rtl8365mb` \u2014 including `mutex`, `spinlock_t`, and eleven `delayed_work`/`timer_list` structures carrying kernel function pointers \u2014 past the end of the allocation, and `rtl8366rb_change_mtu()` writes an attacker-supplied MTU value there at runtime. Because that OOB-resident work item\u0027s function pointer is repeatedly armed and dereferenced by `schedule_delayed_work()`, corruption of an overlapping slab object yields a control-flow-relevant primitive rather than a mere data clobber.\nA:H - Under KASAN the access produces an immediate slab-out-of-bounds report (panic with `panic_on_warn`), and under SLUB redzoning the overwritten poison triggers a corruption BUG at free. On lockdep/debug-instrumented builds the inflated lock and work structures push the required size past the `kmalloc-8192` bucket so the write lands in a neighbouring live object, and a timer whose function pointer resides in that clobbered memory is dereferenced periodically \u2014 a reliable route to an oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:53.228Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc0f9bb99735d2b68fac68f37b585d615728ce5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe668aa499b4b95425044ba11af9609db6ecf466"
        },
        {
          "url": "https://git.kernel.org/stable/c/b93eb564869321d0dffaf23fcc5c88112ed62466"
        }
      ],
      "title": "net: dsa: realtek: fix out-of-bounds access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54065",
    "datePublished": "2025-12-24T12:23:10.745Z",
    "dateReserved": "2025-12-24T12:21:05.092Z",
    "dateUpdated": "2026-08-05T09:16:53.228Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54065",
      "date": "2026-09-28",
      "epss": "0.00152",
      "percentile": "0.03691"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/dsa/realtek/realtek-mdio.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cc0f9bb99735d2b68fac68f37b585d615728ce5b",
                    "status": "affected",
                    "version": "aac94001067da183455d6d37959892744fa01d9d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fe668aa499b4b95425044ba11af9609db6ecf466",
                    "status": "affected",
                    "version": "aac94001067da183455d6d37959892744fa01d9d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b93eb564869321d0dffaf23fcc5c88112ed62466",
                    "status": "affected",
                    "version": "aac94001067da183455d6d37959892744fa01d9d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/dsa/realtek/realtek-mdio.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: realtek: fix out-of-bounds access\n\nThe probe function sets priv-\u003echip_data to (void *)priv + sizeof(*priv)\nwith the expectation that priv has enough trailing space.\n\nHowever, only realtek-smi actually allocated this chip_data space.\nDo likewise in realtek-mdio to fix out-of-bounds accesses.\n\nThese accesses likely went unnoticed so far, because of an (unused)\nbuf[4096] member in struct realtek_priv, which caused kmalloc to\nround up the allocated buffer to a big enough size, so nothing of\nvalue was overwritten. With a different allocator (like in the barebox\nbootloader port of the driver) or with KASAN, the memory corruption\nbecomes quickly apparent."
          }
        ],
        "id": "CVE-2023-54065",
        "lastModified": "2026-08-04T10:19:27.090",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-24T13:16:08.337",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b93eb564869321d0dffaf23fcc5c88112ed62466"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cc0f9bb99735d2b68fac68f37b585d615728ce5b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fe668aa499b4b95425044ba11af9609db6ecf466"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T12:43:15+00:00",
      "cve": "CVE-2023-54065",
      "id": "CVE-2023-54065",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Privilege escalation in Realtek MDIO driver due to out-of-bounds write",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54065.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:54:24Z",
      "cve": "CVE-2023-54065",
      "id": "CVE-2023-54065",
      "initial_release_date": "2025-12-25T00:56:28Z",
      "product_status:known_not_affected": "560",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54065",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54065.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.