Vulnerability-Lookup

GHSA-WH7J-WV38-GCF6

Vulnerability from github – Published: 2025-10-04 18:31 – Updated: 2026-02-10 00:30

Details

In the Linux kernel, the following vulnerability has been resolved:

net: bcmgenet: Add a check for oversized packets

Occasionnaly we may get oversized packets from the hardware which exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early check which drops the packet to avoid invoking skb_over_panic() and move on to processing the next packet.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-53535"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-04T16:15:48Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: Add a check for oversized packets\n\nOccasionnaly we may get oversized packets from the hardware which\nexceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early\ncheck which drops the packet to avoid invoking skb_over_panic() and move\non to processing the next packet.",
  "id": "GHSA-wh7j-wv38-gcf6",
  "modified": "2026-02-10T00:30:27Z",
  "published": "2025-10-04T18:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53535"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/124ca24e0de958d2e20e0aa1e2434af7b72f8887"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/411317d2a4a7d6049d8efeef0d32ae43f8baefce"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5c0862c2c962052ed5055220a00ac1cefb92fbcd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5f56767fb5f2df875b6553e08dbec6a45431c988"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7cdb07e10c1258c08f31b24898930e4ece88d163"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/841881320562cbeac7046b537b91cd000480cea2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/87363d1ab55e497702a9506ff423c422639c8a25"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c34b1c0870323649d45c5074828d7f754dea2673"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-53535 (GCVE-0-2023-53535)

Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2026-08-05 09:14

Title

net: bcmgenet: Add a check for oversized packets

Summary

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: Add a check for oversized packets Occasionnaly we may get oversized packets from the hardware which exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early check which drops the packet to avoid invoking skb_over_panic() and move on to processing the next packet.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/7cdb07e10c1258c08…
https://git.kernel.org/stable/c/c34b1c0870323649d…
https://git.kernel.org/stable/c/87363d1ab55e49770…
https://git.kernel.org/stable/c/841881320562cbeac…
https://git.kernel.org/stable/c/124ca24e0de958d2e…
https://git.kernel.org/stable/c/5f56767fb5f2df875…
https://git.kernel.org/stable/c/411317d2a4a7d6049…
https://git.kernel.org/stable/c/5c0862c2c962052ed…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 7cdb07e10c1258c08f31b24898930e4ece88d163 (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < c34b1c0870323649d45c5074828d7f754dea2673 (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 87363d1ab55e497702a9506ff423c422639c8a25 (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 841881320562cbeac7046b537b91cd000480cea2 (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 124ca24e0de958d2e20e0aa1e2434af7b72f8887 (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 5f56767fb5f2df875b6553e08dbec6a45431c988 (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 411317d2a4a7d6049d8efeef0d32ae43f8baefce (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 5c0862c2c962052ed5055220a00ac1cefb92fbcd (git)
Linux	Linux	Affected: 3.15 Unaffected: 0 , < 3.15 (semver) Unaffected: 4.14.308 , ≤ 4.14.* (semver) Unaffected: 4.19.276 , ≤ 4.19.* (semver) Unaffected: 5.4.235 , ≤ 5.4.* (semver) Unaffected: 5.10.173 , ≤ 5.10.* (semver) Unaffected: 5.15.99 , ≤ 5.15.* (semver) Unaffected: 6.1.16 , ≤ 6.1.* (semver) Unaffected: 6.2.3 , ≤ 6.2.* (semver) Unaffected: 6.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/genet/bcmgenet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7cdb07e10c1258c08f31b24898930e4ece88d163",
              "status": "affected",
              "version": "1c1008c793fa46703a2fee469f4235e1c7984333",
              "versionType": "git"
            },
            {
              "lessThan": "c34b1c0870323649d45c5074828d7f754dea2673",
              "status": "affected",
              "version": "1c1008c793fa46703a2fee469f4235e1c7984333",
              "versionType": "git"
            },
            {
              "lessThan": "87363d1ab55e497702a9506ff423c422639c8a25",
              "status": "affected",
              "version": "1c1008c793fa46703a2fee469f4235e1c7984333",
              "versionType": "git"
            },
            {
              "lessThan": "841881320562cbeac7046b537b91cd000480cea2",
              "status": "affected",
              "version": "1c1008c793fa46703a2fee469f4235e1c7984333",
              "versionType": "git"
            },
            {
              "lessThan": "124ca24e0de958d2e20e0aa1e2434af7b72f8887",
              "status": "affected",
              "version": "1c1008c793fa46703a2fee469f4235e1c7984333",
              "versionType": "git"
            },
            {
              "lessThan": "5f56767fb5f2df875b6553e08dbec6a45431c988",
              "status": "affected",
              "version": "1c1008c793fa46703a2fee469f4235e1c7984333",
              "versionType": "git"
            },
            {
              "lessThan": "411317d2a4a7d6049d8efeef0d32ae43f8baefce",
              "status": "affected",
              "version": "1c1008c793fa46703a2fee469f4235e1c7984333",
              "versionType": "git"
            },
            {
              "lessThan": "5c0862c2c962052ed5055220a00ac1cefb92fbcd",
              "status": "affected",
              "version": "1c1008c793fa46703a2fee469f4235e1c7984333",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/genet/bcmgenet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.308",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.173",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.308",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.276",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.235",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.173",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.99",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.16",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.3",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: Add a check for oversized packets\n\nOccasionnaly we may get oversized packets from the hardware which\nexceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early\ncheck which drops the packet to avoid invoking skb_over_panic() and move\non to processing the next packet."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable code is the bcmgenet RX descriptor path executed on every Ethernet/MoCA frame the MAC delivers, so the attacker only needs to inject traffic onto the same L2 segment as the Raspberry Pi 4/CM4 or Broadcom set-top box. An RX buffer length above 2048 requires a link-layer framing/oversize condition that cannot survive routing (UMAC_MAX_FRAME_LEN is 1536 and path MTU caps routed frames), so this is adjacent rather than fully remote.\nAC:L - The attacker fully controls the volume, size and framing of the traffic hitting the MAC and can retry indefinitely at line rate at zero cost; there is no race to win, no memory layout to groom, and no target state the attacker cannot influence. Repeatable free retries against a condition the maintainer describes as occurring during normal reception make this Low.\nPR:N - No account, credential, or capability on the target is needed \u2014 bcmgenet_desc_rx() runs in NAPI softirq context on received frames long before any authentication, filtering, or socket-layer authorization is consulted. Any host on the shared Ethernet/coax segment can reach it.\nUI:N - No victim action is required; the interface merely has to be up and receiving, which is its normal operating state. The vulnerable skb_put() executes automatically for every descriptor processed.\nS:U - The panic and the stale-memory read both occur in the host kernel\u0027s own security authority, with no VM, hypervisor, IOMMU, or sandbox boundary crossed. Standard kernel-local impact.\nC:L - For len values between the 2048-byte DMA region and the 2112-byte SKB tailroom, skb_put() succeeds and hands up to 64 bytes of stale per-CPU page_frag memory (leftovers of previously received packets) to the network stack, where a bridging/forwarding deployment can transmit it back onto the wire. The read is hard-capped by skb-\u003eend and the IP stack trims it in most paths, so the disclosure is real but strictly bounded.\nI:N - The RDMA ring\u0027s DMA_RING_BUF_SIZE is programmed with RX_BUF_LENGTH, so the hardware never writes past the 2048-byte mapping \u2014 the bug is a bogus length report, not an out-of-bounds write. No kernel memory is corrupted and no control-flow or data-write primitive is obtained.\nA:H - Any reported length above 2112 drives skb_put() into skb_over_panic(), which calls BUG() from softirq context, taking the machine down immediately (the unmasked 16-bit shift permits lengths up to 65535, far past the limit). This is a full denial of service reachable from the network with no credentials."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:39.345Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7cdb07e10c1258c08f31b24898930e4ece88d163"
        },
        {
          "url": "https://git.kernel.org/stable/c/c34b1c0870323649d45c5074828d7f754dea2673"
        },
        {
          "url": "https://git.kernel.org/stable/c/87363d1ab55e497702a9506ff423c422639c8a25"
        },
        {
          "url": "https://git.kernel.org/stable/c/841881320562cbeac7046b537b91cd000480cea2"
        },
        {
          "url": "https://git.kernel.org/stable/c/124ca24e0de958d2e20e0aa1e2434af7b72f8887"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f56767fb5f2df875b6553e08dbec6a45431c988"
        },
        {
          "url": "https://git.kernel.org/stable/c/411317d2a4a7d6049d8efeef0d32ae43f8baefce"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c0862c2c962052ed5055220a00ac1cefb92fbcd"
        }
      ],
      "title": "net: bcmgenet: Add a check for oversized packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53535",
    "datePublished": "2025-10-04T15:16:46.583Z",
    "dateReserved": "2025-10-04T15:14:15.919Z",
    "dateUpdated": "2026-08-05T09:14:39.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.