« Volver al listado

CVE-2023-54295

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type

spi_nor_set_erase_type() was used either to set or to mask out an erase type. When we used it to mask out an erase type a shift-out-of-bounds was hit: UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 shift exponent 4294967295 is too large for 32-bit type 'int'

The setting of the size_{shift, mask} and of the opcode are unnecessary when the erase size is zero, as throughout the code just the erase size is considered to determine whether an erase type is supported or not.

Leer descripción completaMostrar menos

Setting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF is an unused opcode. Thus when masking out an erase type, just set the erase size to zero. This will fix the shift-out-of-bounds.

[ta: refine changes, new commit message, fix compilation error]

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-54295",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5390a8df769ec9ba9c995191bb0867430f602ebb",
              "lessThan": "e6409208c13f7c56adc12dd795abf4141e3d5e64",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5390a8df769ec9ba9c995191bb0867430f602ebb",
              "lessThan": "61d44a4db2f54dbac7d22c2541574ea5755e0468",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5390a8df769ec9ba9c995191bb0867430f602ebb",
              "lessThan": "53b2916ebde741c657a857fa1936c0d9fcb59170",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5390a8df769ec9ba9c995191bb0867430f602ebb",
              "lessThan": "99341b8aee7b5b4255b339345bbcaa35867dfd0c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5390a8df769ec9ba9c995191bb0867430f602ebb",
              "lessThan": "f0f0cfdc3a024e21161714f2e05f0df3b84d42ad",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/mtd/spi-nor/core.c",
            "drivers/mtd/spi-nor/core.h",
            "drivers/mtd/spi-nor/sfdp.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.20",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.173",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.99",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.*"
            },
            {
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/mtd/spi-nor/core.c",
            "drivers/mtd/spi-nor/core.h",
            "drivers/mtd/spi-nor/sfdp.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-30T13:16:18.593",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/53b2916ebde741c657a857fa1936c0d9fcb59170",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/61d44a4db2f54dbac7d22c2541574ea5755e0468",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/99341b8aee7b5b4255b339345bbcaa35867dfd0c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e6409208c13f7c56adc12dd795abf4141e3d5e64",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f0f0cfdc3a024e21161714f2e05f0df3b84d42ad",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type\n\nspi_nor_set_erase_type() was used either to set or to mask out an erase\ntype. When we used it to mask out an erase type a shift-out-of-bounds\nwas hit:\nUBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24\nshift exponent 4294967295 is too large for 32-bit type 'int'\n\nThe setting of the size_{shift, mask} and of the opcode are unnecessary\nwhen the erase size is zero, as throughout the code just the erase size\nis considered to determine whether an erase type is supported or not.\nSetting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF\nis an unused opcode. Thus when masking out an erase type, just set the\nerase size to zero. This will fix the shift-out-of-bounds.\n\n[ta: refine changes, new commit message, fix compilation error]"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmtd: spi-nor: Solución para el desbordamiento de desplazamiento en spi_nor_set_erase_type\n\nspi_nor_set_erase_type() se utilizaba ya sea para establecer o para enmascarar un tipo de borrado. Cuando lo utilizábamos para enmascarar un tipo de borrado, se producía un desbordamiento de desplazamiento:\nUBSAN: desbordamiento de desplazamiento en drivers/mtd/spi-nor/core.c:2237:24\nel exponente de desplazamiento 4294967295 es demasiado grande para el tipo 'int' de 32 bits\n\nLa configuración de size_{shift, mask} y del código de operación son innecesarias cuando el tamaño de borrado es cero, ya que a lo largo del código solo se considera el tamaño de borrado para determinar si un tipo de borrado es compatible o no. Establecer el código de operación a 0xFF también era incorrecto, ya que nadie garantiza que 0xFF sea un código de operación no utilizado. Por lo tanto, al enmascarar un tipo de borrado, simplemente establezca el tamaño de borrado a cero. Esto solucionará el desbordamiento de desplazamiento.\n\n[ta: refinar cambios, nuevo mensaje de commit, corregir error de compilación]"
    }
  ],
  "lastModified": "2026-06-17T06:47:10.507",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}