CVE-2023-52494 bus: mhi: host: Add alignment check for event ring read pointer

What is CVE-2023-52494?

CVE-2023-52494 is a high-severity memory corruption vulnerability in Linux kernel, published on 29 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: host: Add alignment check for event ring read pointer

Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption.

So add a alignment check for event ring read pointer.

Weakness: CWE-787

Which versions are affected by CVE-2023-52494?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2023-52494?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-52494 being exploited?

There is no known exploitation of CVE-2023-52494 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2023-52494, DEBIAN-CVE-2023-52494, GHSA-ggvx-h8v5-pm3j, ROOT-OS-DEBIAN-11-CVE-2023-52494, UBUNTU-CVE-2023-52494.