CVE-2023-53059

platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl

Description

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl It is possible to peep kernel page's data by providing larger `insize` in struct cros_ec_command[1] when invoking EC host commands. Fix it by using zeroed memory. [1]: https://elixir.bootlin.com/linux/v6.2/source/include/linux/platform_data/cros_ec_proto.h#L74

N/A

CVSS

Severity:

EPSS 0.03%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/13493ad6a220cb3f6f3552a16b4f2753a118b633
https://git.kernel.org/stable/c/f86ff88a1548ccf5a13960c0e7625ca787ea0993
https://git.kernel.org/stable/c/ebea2e16504f40d2c2bac42ad5c5a3de5ce034b4
https://git.kernel.org/stable/c/eab28bfafcd1245a3510df9aa9eb940589956ea6
https://git.kernel.org/stable/c/a0d8644784f73fa39f57f72f374eefaba2bf48a0
https://git.kernel.org/stable/c/b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3

Frequently Asked Questions

What is the severity of CVE-2023-53059?: CVE-2023-53059 has not yet been assigned a CVSS score.
How to fix CVE-2023-53059?: To fix CVE-2023-53059, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-53059 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2023-53059 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-53059?: CVE-2023-53059 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.