Strix
26.1K

CVE-2023-53748

HIGHCVSS 7.1/10EPSS 0.16%

Last modified

CVE-2023-53748 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds. Fix this bug by checking *nplanes against the array size.

Metrics

CVSS 3.1
7.1/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS Probability
0.16%

6.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 590577a4e5257ac3ed72999a94666ad6ba8f24bc, < 48e4e06e2c5fe1fda283d499f91492eda2248bb9; >= 590577a4e5257ac3ed72999a94666ad6ba8f24bc, < b8e19bf3b4aebd855be01b64674187dcf6d1db51; >= 590577a4e5257ac3ed72999a94666ad6ba8f24bc, < 8fbcf730cb89c3647f3365226fe7014118fa93c7
LinuxLinux4.10

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2023-53748?
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds. Fix this bug by checking *nplanes against the array size.
How severe is CVE-2023-53748?
CVE-2023-53748 has a CVSS score of 7.1/10 (HIGH severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2023-53748?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2023

View all 2023CVEs →

Are you affected by CVE-2023-53748?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST