GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53667 (GCVE-0-2023-53667)

Vulnerability from cvelistv5 – Published: 2025-10-07 15:21 – Updated: 2026-05-11 19:49
VLAI
Title
net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
Summary
In the Linux kernel, the following vulnerability has been resolved: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than the calculated "min" value, but greater than zero, the logic sets tx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in cdc_ncm_fill_tx_frame() where all the data is handled. For small values of dwNtbOutMaxSize the memory allocated during alloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to how size is aligned at alloc time: size = SKB_DATA_ALIGN(size); size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); Thus we hit the same bug that we tried to squash with commit 2be6d4d16a084 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero") Low values of dwNtbOutMaxSize do not cause an issue presently because at alloc_skb() time more memory (512b) is allocated than required for the SKB headers alone (320b), leaving some space (512b - 320b = 192b) for CDC data (172b). However, if more elements (for example 3 x u64 = [24b]) were added to one of the SKB header structs, say 'struct skb_shared_info', increasing its original size (320b [320b aligned]) to something larger (344b [384b aligned]), then suddenly the CDC data (172b) no longer fits in the spare SKB data area (512b - 384b = 128b). Consequently the SKB bounds checking semantics fails and panics: skbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:113! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic net/core/skbuff.c:113 [inline] RIP: 0010:skb_over_panic+0x14c/0x150 net/core/skbuff.c:118 [snip] Call Trace: <TASK> skb_put+0x151/0x210 net/core/skbuff.c:2047 skb_put_zero include/linux/skbuff.h:2422 [inline] cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline] cdc_ncm_fill_tx_frame+0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308 cdc_ncm_tx_fixup+0xa3/0x100 Deal with too low values of dwNtbOutMaxSize, clamp it in the range [USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure enough data space is allocated to handle CDC data by making sure dwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 289507d3364f96f4b8814726917d572f71350d87 , < 2334ff0b343ba6ba7a6c0586fcc83992bbbc1776 (git)
Affected: 289507d3364f96f4b8814726917d572f71350d87 , < bf415bfe7573596ac213b4fd1da9e62cfc9a9413 (git)
Affected: 289507d3364f96f4b8814726917d572f71350d87 , < ff484163dfb61b58f23e4dbd007de1094427669c (git)
Affected: 289507d3364f96f4b8814726917d572f71350d87 , < 42b78c8cc774b47023d6d16d96d54cc7015e4a07 (git)
Affected: 289507d3364f96f4b8814726917d572f71350d87 , < 9be921854e983a81a0aeeae5febcd87093086e46 (git)
Affected: 289507d3364f96f4b8814726917d572f71350d87 , < 6147745d43ff4e0d2c542e5b93e398ef0ee4db00 (git)
Affected: 289507d3364f96f4b8814726917d572f71350d87 , < 72d0240b0ee4794efc683975c213e4b384fea733 (git)
Affected: 289507d3364f96f4b8814726917d572f71350d87 , < 7e01c7f7046efc2c7c192c3619db43292b98e997 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.16
Unaffected: 0 , < 3.16 (semver)
Unaffected: 4.14.317 , ≤ 4.14.* (semver)
Unaffected: 4.19.285 , ≤ 4.19.* (semver)
Unaffected: 5.4.245 , ≤ 5.4.* (semver)
Unaffected: 5.10.181 , ≤ 5.10.* (semver)
Unaffected: 5.15.114 , ≤ 5.15.* (semver)
Unaffected: 6.1.31 , ≤ 6.1.* (semver)
Unaffected: 6.3.5 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/cdc_ncm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2334ff0b343ba6ba7a6c0586fcc83992bbbc1776",
              "status": "affected",
              "version": "289507d3364f96f4b8814726917d572f71350d87",
              "versionType": "git"
            },
            {
              "lessThan": "bf415bfe7573596ac213b4fd1da9e62cfc9a9413",
              "status": "affected",
              "version": "289507d3364f96f4b8814726917d572f71350d87",
              "versionType": "git"
            },
            {
              "lessThan": "ff484163dfb61b58f23e4dbd007de1094427669c",
              "status": "affected",
              "version": "289507d3364f96f4b8814726917d572f71350d87",
              "versionType": "git"
            },
            {
              "lessThan": "42b78c8cc774b47023d6d16d96d54cc7015e4a07",
              "status": "affected",
              "version": "289507d3364f96f4b8814726917d572f71350d87",
              "versionType": "git"
            },
            {
              "lessThan": "9be921854e983a81a0aeeae5febcd87093086e46",
              "status": "affected",
              "version": "289507d3364f96f4b8814726917d572f71350d87",
              "versionType": "git"
            },
            {
              "lessThan": "6147745d43ff4e0d2c542e5b93e398ef0ee4db00",
              "status": "affected",
              "version": "289507d3364f96f4b8814726917d572f71350d87",
              "versionType": "git"
            },
            {
              "lessThan": "72d0240b0ee4794efc683975c213e4b384fea733",
              "status": "affected",
              "version": "289507d3364f96f4b8814726917d572f71350d87",
              "versionType": "git"
            },
            {
              "lessThan": "7e01c7f7046efc2c7c192c3619db43292b98e997",
              "status": "affected",
              "version": "289507d3364f96f4b8814726917d572f71350d87",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/cdc_ncm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.317",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.317",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.285",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.245",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.181",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.114",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.31",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.5",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cdc_ncm: Deal with too low values of dwNtbOutMaxSize\n\nCurrently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than\nthe calculated \"min\" value, but greater than zero, the logic sets\ntx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in\ncdc_ncm_fill_tx_frame() where all the data is handled.\n\nFor small values of dwNtbOutMaxSize the memory allocated during\nalloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to\nhow size is aligned at alloc time:\n\tsize = SKB_DATA_ALIGN(size);\n        size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));\nThus we hit the same bug that we tried to squash with\ncommit 2be6d4d16a084 (\"net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero\")\n\nLow values of dwNtbOutMaxSize do not cause an issue presently because at\nalloc_skb() time more memory (512b) is allocated than required for the\nSKB headers alone (320b), leaving some space (512b - 320b = 192b)\nfor CDC data (172b).\n\nHowever, if more elements (for example 3 x u64 = [24b]) were added to\none of the SKB header structs, say \u0027struct skb_shared_info\u0027,\nincreasing its original size (320b [320b aligned]) to something larger\n(344b [384b aligned]), then suddenly the CDC data (172b) no longer\nfits in the spare SKB data area (512b - 384b = 128b).\n\nConsequently the SKB bounds checking semantics fails and panics:\n\nskbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:\u003cNULL\u003e\n------------[ cut here ]------------\nkernel BUG at net/core/skbuff.c:113!\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN\nCPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023\nWorkqueue: mld mld_ifc_work\nRIP: 0010:skb_panic net/core/skbuff.c:113 [inline]\nRIP: 0010:skb_over_panic+0x14c/0x150 net/core/skbuff.c:118\n[snip]\nCall Trace:\n \u003cTASK\u003e\n skb_put+0x151/0x210 net/core/skbuff.c:2047\n skb_put_zero include/linux/skbuff.h:2422 [inline]\n cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline]\n cdc_ncm_fill_tx_frame+0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308\n cdc_ncm_tx_fixup+0xa3/0x100\n\nDeal with too low values of dwNtbOutMaxSize, clamp it in the range\n[USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure\nenough data space is allocated to handle CDC data by making sure\ndwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:49:35.341Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2334ff0b343ba6ba7a6c0586fcc83992bbbc1776"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf415bfe7573596ac213b4fd1da9e62cfc9a9413"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff484163dfb61b58f23e4dbd007de1094427669c"
        },
        {
          "url": "https://git.kernel.org/stable/c/42b78c8cc774b47023d6d16d96d54cc7015e4a07"
        },
        {
          "url": "https://git.kernel.org/stable/c/9be921854e983a81a0aeeae5febcd87093086e46"
        },
        {
          "url": "https://git.kernel.org/stable/c/6147745d43ff4e0d2c542e5b93e398ef0ee4db00"
        },
        {
          "url": "https://git.kernel.org/stable/c/72d0240b0ee4794efc683975c213e4b384fea733"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e01c7f7046efc2c7c192c3619db43292b98e997"
        }
      ],
      "title": "net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53667",
    "datePublished": "2025-10-07T15:21:25.185Z",
    "dateReserved": "2025-10-07T15:16:59.662Z",
    "dateUpdated": "2026-05-11T19:49:35.341Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53667",
      "date": "2026-09-17",
      "epss": "0.00145",
      "percentile": "0.04181"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53667\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-07T16:15:50.513\",\"lastModified\":\"2026-06-17T06:45:49.863\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: cdc_ncm: Deal with too low values of dwNtbOutMaxSize\\n\\nCurrently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than\\nthe calculated \\\"min\\\" value, but greater than zero, the logic sets\\ntx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in\\ncdc_ncm_fill_tx_frame() where all the data is handled.\\n\\nFor small values of dwNtbOutMaxSize the memory allocated during\\nalloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to\\nhow size is aligned at alloc time:\\n\\tsize = SKB_DATA_ALIGN(size);\\n        size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));\\nThus we hit the same bug that we tried to squash with\\ncommit 2be6d4d16a084 (\\\"net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero\\\")\\n\\nLow values of dwNtbOutMaxSize do not cause an issue presently because at\\nalloc_skb() time more memory (512b) is allocated than required for the\\nSKB headers alone (320b), leaving some space (512b - 320b = 192b)\\nfor CDC data (172b).\\n\\nHowever, if more elements (for example 3 x u64 = [24b]) were added to\\none of the SKB header structs, say \u0027struct skb_shared_info\u0027,\\nincreasing its original size (320b [320b aligned]) to something larger\\n(344b [384b aligned]), then suddenly the CDC data (172b) no longer\\nfits in the spare SKB data area (512b - 384b = 128b).\\n\\nConsequently the SKB bounds checking semantics fails and panics:\\n\\nskbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:\u003cNULL\u003e\\n------------[ cut here ]------------\\nkernel BUG at net/core/skbuff.c:113!\\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN\\nCPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023\\nWorkqueue: mld mld_ifc_work\\nRIP: 0010:skb_panic net/core/skbuff.c:113 [inline]\\nRIP: 0010:skb_over_panic+0x14c/0x150 net/core/skbuff.c:118\\n[snip]\\nCall Trace:\\n \u003cTASK\u003e\\n skb_put+0x151/0x210 net/core/skbuff.c:2047\\n skb_put_zero include/linux/skbuff.h:2422 [inline]\\n cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline]\\n cdc_ncm_fill_tx_frame+0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308\\n cdc_ncm_tx_fixup+0xa3/0x100\\n\\nDeal with too low values of dwNtbOutMaxSize, clamp it in the range\\n[USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure\\nenough data space is allocated to handle CDC data by making sure\\ndwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/usb/cdc_ncm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"289507d3364f96f4b8814726917d572f71350d87\",\"lessThan\":\"2334ff0b343ba6ba7a6c0586fcc83992bbbc1776\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"289507d3364f96f4b8814726917d572f71350d87\",\"lessThan\":\"bf415bfe7573596ac213b4fd1da9e62cfc9a9413\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"289507d3364f96f4b8814726917d572f71350d87\",\"lessThan\":\"ff484163dfb61b58f23e4dbd007de1094427669c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"289507d3364f96f4b8814726917d572f71350d87\",\"lessThan\":\"42b78c8cc774b47023d6d16d96d54cc7015e4a07\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"289507d3364f96f4b8814726917d572f71350d87\",\"lessThan\":\"9be921854e983a81a0aeeae5febcd87093086e46\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"289507d3364f96f4b8814726917d572f71350d87\",\"lessThan\":\"6147745d43ff4e0d2c542e5b93e398ef0ee4db00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"289507d3364f96f4b8814726917d572f71350d87\",\"lessThan\":\"72d0240b0ee4794efc683975c213e4b384fea733\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"289507d3364f96f4b8814726917d572f71350d87\",\"lessThan\":\"7e01c7f7046efc2c7c192c3619db43292b98e997\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/usb/cdc_ncm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.317\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.285\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.245\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.181\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.114\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.31\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.5\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.16\",\"versionEndExcluding\":\"4.14.317\",\"matchCriteriaId\":\"D58CAFE5-010D-4B7E-87DE-47F077D0AB6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.285\",\"matchCriteriaId\":\"286C59EF-E841-4ED4-8EBC-3886E88D5A6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.245\",\"matchCriteriaId\":\"3571627D-1A0A-4EAA-9F5E-58080584055F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.181\",\"matchCriteriaId\":\"F5B1726B-45AA-47F2-9261-6DC963E92248\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.114\",\"matchCriteriaId\":\"AA68825D-6B30-4C99-9E36-C690FE7F9AB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.31\",\"matchCriteriaId\":\"79A1436B-7738-4A85-8FE6-B844059F22D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.3.5\",\"matchCriteriaId\":\"34DD94CA-4DA1-41C3-9A9B-92ACD7F4E240\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"38BC6744-7D25-4C02-9966-B224CD071D30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"76061B41-CAE9-4467-BEDE-0FFC7956F2A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A717BA5B-D535-46A0-A329-A25FE5CEC588\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2334ff0b343ba6ba7a6c0586fcc83992bbbc1776\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/42b78c8cc774b47023d6d16d96d54cc7015e4a07\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6147745d43ff4e0d2c542e5b93e398ef0ee4db00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72d0240b0ee4794efc683975c213e4b384fea733\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7e01c7f7046efc2c7c192c3619db43292b98e997\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9be921854e983a81a0aeeae5febcd87093086e46\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bf415bfe7573596ac213b4fd1da9e62cfc9a9413\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff484163dfb61b58f23e4dbd007de1094427669c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T22:33:18+00:00",
      "cve": "CVE-2023-53667",
      "id": "CVE-2023-53667",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53667.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.