github - ghsa-qhgr-vhx2-3qm4

ghsa-qhgr-vhx2-3qm4

Vulnerability from github

Published

2025-10-01 12:30

Modified

2025-10-01 12:30

Details

In the Linux kernel, the following vulnerability has been resolved:

soundwire: qcom: fix storing port config out-of-bounds

The 'qcom_swrm_ctrl->pconfig' has size of QCOM_SDW_MAX_PORTS (14), however we index it starting from 1, not 0, to match real port numbers. This can lead to writing port config past 'pconfig' bounds and overwriting next member of 'qcom_swrm_ctrl' struct. Reported also by smatch:

drivers/soundwire/qcom.c:1269 qcom_swrm_get_port_config() error: buffer overflow 'ctrl->pconfig' 14 <= 14

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-53465"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-01T12:15:48Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: qcom: fix storing port config out-of-bounds\n\nThe \u0027qcom_swrm_ctrl-\u003epconfig\u0027 has size of QCOM_SDW_MAX_PORTS (14),\nhowever we index it starting from 1, not 0, to match real port numbers.\nThis can lead to writing port config past \u0027pconfig\u0027 bounds and\noverwriting next member of \u0027qcom_swrm_ctrl\u0027 struct.  Reported also by\nsmatch:\n\n  drivers/soundwire/qcom.c:1269 qcom_swrm_get_port_config() error: buffer overflow \u0027ctrl-\u003epconfig\u0027 14 \u003c= 14",
  "id": "GHSA-qhgr-vhx2-3qm4",
  "modified": "2025-10-01T12:30:29Z",
  "published": "2025-10-01T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53465"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/20f7c4d51c94abb1a1a7c21900db4fb5afe5c8ff"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/32eb67d7360d48c15883e0d21b29c0aab9da022e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/490937d479abe5f6584e69b96df066bc87be92e9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/801daff0078087b5df9145c9f5e643c28129734b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2023-53465 (GCVE-0-2023-53465)

Vulnerability from cvelistv5

Published

2025-10-01 11:42

Modified

2025-10-01 11:42

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: soundwire: qcom: fix storing port config out-of-bounds The 'qcom_swrm_ctrl->pconfig' has size of QCOM_SDW_MAX_PORTS (14), however we index it starting from 1, not 0, to match real port numbers. This can lead to writing port config past 'pconfig' bounds and overwriting next member of 'qcom_swrm_ctrl' struct. Reported also by smatch: drivers/soundwire/qcom.c:1269 qcom_swrm_get_port_config() error: buffer overflow 'ctrl->pconfig' 14 <= 14

References

▼	URL	Tags
	https://git.kernel.org/stable/c/20f7c4d51c94abb1a1a7c21900db4fb5afe5c8ff
	https://git.kernel.org/stable/c/801daff0078087b5df9145c9f5e643c28129734b
	https://git.kernel.org/stable/c/32eb67d7360d48c15883e0d21b29c0aab9da022e
	https://git.kernel.org/stable/c/490937d479abe5f6584e69b96df066bc87be92e9

Impacted products

Vendor

Product

Version

▼

Linux

Version: 9916c02ccd74e672b62dd1a9017ac2f237ebf512
Version: 9916c02ccd74e672b62dd1a9017ac2f237ebf512
Version: 9916c02ccd74e672b62dd1a9017ac2f237ebf512
Version: 9916c02ccd74e672b62dd1a9017ac2f237ebf512

Linux

Version: 5.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/soundwire/qcom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "20f7c4d51c94abb1a1a7c21900db4fb5afe5c8ff",
              "status": "affected",
              "version": "9916c02ccd74e672b62dd1a9017ac2f237ebf512",
              "versionType": "git"
            },
            {
              "lessThan": "801daff0078087b5df9145c9f5e643c28129734b",
              "status": "affected",
              "version": "9916c02ccd74e672b62dd1a9017ac2f237ebf512",
              "versionType": "git"
            },
            {
              "lessThan": "32eb67d7360d48c15883e0d21b29c0aab9da022e",
              "status": "affected",
              "version": "9916c02ccd74e672b62dd1a9017ac2f237ebf512",
              "versionType": "git"
            },
            {
              "lessThan": "490937d479abe5f6584e69b96df066bc87be92e9",
              "status": "affected",
              "version": "9916c02ccd74e672b62dd1a9017ac2f237ebf512",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/soundwire/qcom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.121",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.40",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.5",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: qcom: fix storing port config out-of-bounds\n\nThe \u0027qcom_swrm_ctrl-\u003epconfig\u0027 has size of QCOM_SDW_MAX_PORTS (14),\nhowever we index it starting from 1, not 0, to match real port numbers.\nThis can lead to writing port config past \u0027pconfig\u0027 bounds and\noverwriting next member of \u0027qcom_swrm_ctrl\u0027 struct.  Reported also by\nsmatch:\n\n  drivers/soundwire/qcom.c:1269 qcom_swrm_get_port_config() error: buffer overflow \u0027ctrl-\u003epconfig\u0027 14 \u003c= 14"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-01T11:42:36.007Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/20f7c4d51c94abb1a1a7c21900db4fb5afe5c8ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/801daff0078087b5df9145c9f5e643c28129734b"
        },
        {
          "url": "https://git.kernel.org/stable/c/32eb67d7360d48c15883e0d21b29c0aab9da022e"
        },
        {
          "url": "https://git.kernel.org/stable/c/490937d479abe5f6584e69b96df066bc87be92e9"
        }
      ],
      "title": "soundwire: qcom: fix storing port config out-of-bounds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53465",
    "datePublished": "2025-10-01T11:42:36.007Z",
    "dateReserved": "2025-10-01T11:39:39.400Z",
    "dateUpdated": "2025-10-01T11:42:36.007Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted