Log in Start free

Vulnerability · Published May 2, 2025 · Assigned by Linux

CVE-2023-53142ice: copy last block omitted in ice_get_module_eeprom()

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.2%top 87.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ice: copy last block omitted in ice_get_module_eeprom() ice_get_module_eeprom() is broken since commit e9c9692c8a81 ("ice: Reimplement module reads used by ethtool") In this refactor, ice_get_module_eeprom() reads the eeprom in blocks of size 8. But the condition that should protect the buffer overflow ignores the last block. The last block always contains zeros. Bug uncovered by ethtool upstream commit 9538f384b535 ("netlink: eeprom: Defer page requests to individual parsers") After this commit, ethtool reads a block with length = 1; to read the SFF-8024 identifier value. unpatched driver: $ ethtool -m enp65s0f0np0 offset 0x90 length 8 Offset Values ------ ------ 0x0090: 00 00 00 00 00 00 00 00 $ ethtool -m enp65s0f0np0 offset 0x90 length 12 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c 00 00 00 00 $ $ ethtool -m enp65s0f0np0 Offset Values ------ ------ 0x0000: 11 06 06 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 01 08 00 0x0070: 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 patched driver: $ ethtool -m enp65s0f0np0 offset 0x90 length 8 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c $ ethtool -m enp65s0f0np0 offset 0x90 length 12 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c 61 6e 6f 78 $ ethtool -m enp65s0f0np0 Identifier : 0x11 (QSFP28) Extended identifier : 0x00 Extended identifier description : 1.5W max. Power consumption Extended identifier description : No CDR in TX, No CDR in RX Extended identifier description : High Power Class (> 3.5 W) not enabled Connector : 0x23 (No separable connector) Transceiver codes : 0x88 0x00 0x00 0x00 0x00 0x00 0x00 0x00 Transceiver type : 40G Ethernet: 40G Base-CR4 Transceiver type : 25G Ethernet: 25G Base-CR CA-N Encoding : 0x05 (64B/66B) BR, Nominal : 25500Mbps Rate identifier : 0x00 Length (SMF,km) : 0km Length (OM3 50um) : 0m Length (OM2 50um) : 0m Length (OM1 62.5um) : 0m Length (Copper or Active cable) : 1m Transmitter technology : 0xa0 (Copper cable unequalized) Attenuation at 2.5GHz : 4db Attenuation at 5.0GHz : 5db Attenuation at 7.0GHz : 7db Attenuation at 12.9GHz : 10db ........ ....

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.20-1DEBIAN-CVE-2023-53142
Debian:13linux6.1.20-1DEBIAN-CVE-2023-53142
Debian:14linux6.1.20-1DEBIAN-CVE-2023-53142
Ubuntu:22.04:LTSlinux5.15.0-79.86UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-aws5.15.0-1042.47UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-azure5.15.0-1045.52UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1045.52.1UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-gcp5.15.0-1039.47UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-gke5.15.0-1039.44UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1025.30UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-ibm5.15.0-1035.38UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1037.42UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-kvm5.15.0-1039.44UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-79.88UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1030.30UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1016.16UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1002.2UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-oracle5.15.0-1040.46UBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-raspi5.15.0-1035.38UBUNTU-CVE-2023-53142
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-53142
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2023-53142
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1025.29UBUNTU-CVE-2023-53142

Affected products (as reported)

VendorProductVersions
Linux Linux e9c9692c8a81aacf0854f68ab54dc182f8be38e8 – before c813f7a3161481483ae2077651b21bc217c419e0e9c9692c8a81aacf0854f68ab54dc182f8be38e8 – before 90b40ab29298db3a4879c1d3c4e685184386bce6e9c9692c8a81aacf0854f68ab54dc182f8be38e8 – before 8cfbdda65588e75bfbd93e5ee847efcb4796ad09e9c9692c8a81aacf0854f68ab54dc182f8be38e8 – before 84cba1840e68430325ac133a11be06bfb2f7acd8
Linux Linux 5.13

References