Riskcovery

CVE-2023-53059

platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl

State
Published
Severity
Not scored
Published
May 2, 2025
Updated
May 11, 2026
Reserved
May 2, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl

It is possible to peep kernel page's data by providing larger `insize` in struct cros_ec_command[1] when invoking EC host commands.

Fix it by using zeroed memory.

[1]: https://elixir.bootlin.com/linux/v6.2/source/include/linux/platform_data/cros_ec_proto.h#L74

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • eda2e30c6684d67288edb841c6125d48c608a242 to before 13493ad6a220cb3f6f3552a16b4f2753a118b633Affected
  • eda2e30c6684d67288edb841c6125d48c608a242 to before f86ff88a1548ccf5a13960c0e7625ca787ea0993Affected
  • eda2e30c6684d67288edb841c6125d48c608a242 to before ebea2e16504f40d2c2bac42ad5c5a3de5ce034b4Affected
  • eda2e30c6684d67288edb841c6125d48c608a242 to before eab28bfafcd1245a3510df9aa9eb940589956ea6Affected
  • eda2e30c6684d67288edb841c6125d48c608a242 to before a0d8644784f73fa39f57f72f374eefaba2bf48a0Affected
  • eda2e30c6684d67288edb841c6125d48c608a242 to before b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3Affected
LinuxLinux
  • 5.4Affected
  • before 5.4Not affected
  • 5.4.240 through 5.4.*Not affected
  • 5.10.177 through 5.10.*Not affected
  • 5.15.105 through 5.15.*Not affected
  • 6.1.22 through 6.1.*Not affected
  • 6.2.9 through 6.2.*Not affected
  • 6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.