CVE-2023-54198

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-54198", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-30T12:06:44.499Z", "datePublished": "2025-12-30T12:09:04.229Z", "dateUpdated": "2026-10-15T21:41:41.131Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:57.447Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: fix out-of-bounds access in tty_driver_lookup_tty()\n\nWhen specifying an invalid console= device like console=tty3270,\ntty_driver_lookup_tty() returns the tty struct without checking\nwhether index is a valid number.\n\nTo reproduce:\n\nqemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \\\n-kernel ../linux-build-x86/arch/x86/boot/bzImage \\\n-append \"console=ttyS0 console=tty3270\"\n\nThis crashes with:\n\n[ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef\n[ 0.771265] #PF: supervisor read access in kernel mode\n[ 0.771773] #PF: error_code(0x0000) - not-present page\n[ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI\n[ 0.774878] RIP: 0010:tty_open+0x268/0x6f0\n[ 0.784013] chrdev_open+0xbd/0x230\n[ 0.784444] ? cdev_device_add+0x80/0x80\n[ 0.784920] do_dentry_open+0x1e0/0x410\n[ 0.785389] path_openat+0xca9/0x1050\n[ 0.785813] do_filp_open+0xaa/0x150\n[ 0.786240] file_open_name+0x133/0x1b0\n[ 0.786746] filp_open+0x27/0x50\n[ 0.787244] console_on_rootfs+0x14/0x4d\n[ 0.787800] kernel_init_freeable+0x1e4/0x20d\n[ 0.788383] ? rest_init+0xc0/0xc0\n[ 0.788881] kernel_init+0x11/0x120\n[ 0.789356] ret_from_fork+0x22/0x30"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The out-of-bounds access is reached through a local `open()` syscall on the console character device (`tty_open` \u2192 `tty_open_by_driver` \u2192 `tty_driver_lookup_tty`); no network or physical interaction is part of the trigger itself.\nAC:L - On an affected system the OOB read fires deterministically on every open of the console device \u2014 no race, no timing window, and it is freely repeatable, which also lets an unprivileged process groom the adjacent slab objects that the read lands in.\nPR:L - Reaching the code needs only an open() of the console device, which on the plausible worst-case deployments (embedded/appliance and container images that expose /dev/console to non-root, busybox-style rootfs) is available to an ordinary local user; heap grooming to shape the wild pointer likewise needs no privilege.\nUI:N - No victim action is required \u2014 the attacker's own open() triggers the access, and on the reported path `console_on_rootfs()` hits it automatically during kernel init.\nS:U - The out-of-bounds read, the wild-pointer dereference and the refcount write all occur inside the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The read is an unbounded out-of-bounds fetch (index up to INT_MAX elements past a 63-entry array), and the value is then treated as a `struct tty_struct *` whose termios/ldisc/driver fields are dereferenced and exposed through the resulting tty file, giving arbitrary kernel-memory disclosure rather than a bounded few-byte leak.\nI:H - The garbage pointer is passed to `tty_kref_get()` \u2192 `refcount_inc()`, a read-modify-write at an attacker-influenced kernel address, followed by further writes in `tty_lock_interruptible()` and `tty_reopen()` (`tty->count++`, ldisc state) \u2014 a memory-corruption primitive usable for control-flow hijacking.\nA:H - The commit documents a kernel NULL-pointer dereference and Oops in `tty_open+0x268/0x6f0`; the wild-pointer dereference reliably panics the kernel, and on the boot path it prevents the system from coming up at all."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/tty_io.c"], "versions": [{"version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "3df6f492f500a16c231f07ccc6f6ed1302caddf9", "status": "affected", "versionType": "git"}, {"version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "b79109d6470aaae7062998353e3a19449055829d", "status": "affected", "versionType": "git"}, {"version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "953a4a352a0c185460ae1449e4c6e6658e55fdfc", "status": "affected", "versionType": "git"}, {"version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "84ea44dc3e4ecb2632586238014bf6722aa5843b", "status": "affected", "versionType": "git"}, {"version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "f9d9d25ad1f0d060eaf297a2f7f03b5855a45561", "status": "affected", "versionType": "git"}, {"version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "765566110eb0da3cf60198b0165ecceeaafa6444", "status": "affected", "versionType": "git"}, {"version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "fcfeaa570f7a5c2d5f4f14931909531ff18b7fde", "status": "affected", "versionType": "git"}, {"version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "db4df8e9d79e7d37732c1a1b560958e8dadfefa1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/tty_io.c"], "versions": [{"version": "2.6.28", "status": "affected"}, {"version": "0", "lessThan": "2.6.28", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.308", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.276", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.235", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.173", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.100", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.18", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.2.5", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "4.14.308"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "4.19.276"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "5.4.235"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "5.10.173"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "5.15.100"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "6.1.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "6.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "6.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3df6f492f500a16c231f07ccc6f6ed1302caddf9"}, {"url": "https://git.kernel.org/stable/c/b79109d6470aaae7062998353e3a19449055829d"}, {"url": "https://git.kernel.org/stable/c/953a4a352a0c185460ae1449e4c6e6658e55fdfc"}, {"url": "https://git.kernel.org/stable/c/84ea44dc3e4ecb2632586238014bf6722aa5843b"}, {"url": "https://git.kernel.org/stable/c/f9d9d25ad1f0d060eaf297a2f7f03b5855a45561"}, {"url": "https://git.kernel.org/stable/c/765566110eb0da3cf60198b0165ecceeaafa6444"}, {"url": "https://git.kernel.org/stable/c/fcfeaa570f7a5c2d5f4f14931909531ff18b7fde"}, {"url": "https://git.kernel.org/stable/c/db4df8e9d79e7d37732c1a1b560958e8dadfefa1"}], "title": "tty: fix out-of-bounds access in tty_driver_lookup_tty()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54198", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:38:58.741580Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:41.131Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54198", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:38:58.741580Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:39:07.048Z"}}], "cna": {"title": "tty: fix out-of-bounds access in tty_driver_lookup_tty()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The out-of-bounds access is reached through a local `open()` syscall on the console character device (`tty_open` \u2192 `tty_open_by_driver` \u2192 `tty_driver_lookup_tty`); no network or physical interaction is part of the trigger itself.\nAC:L - On an affected system the OOB read fires deterministically on every open of the console device \u2014 no race, no timing window, and it is freely repeatable, which also lets an unprivileged process groom the adjacent slab objects that the read lands in.\nPR:L - Reaching the code needs only an open() of the console device, which on the plausible worst-case deployments (embedded/appliance and container images that expose /dev/console to non-root, busybox-style rootfs) is available to an ordinary local user; heap grooming to shape the wild pointer likewise needs no privilege.\nUI:N - No victim action is required \u2014 the attacker's own open() triggers the access, and on the reported path `console_on_rootfs()` hits it automatically during kernel init.\nS:U - The out-of-bounds read, the wild-pointer dereference and the refcount write all occur inside the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The read is an unbounded out-of-bounds fetch (index up to INT_MAX elements past a 63-entry array), and the value is then treated as a `struct tty_struct *` whose termios/ldisc/driver fields are dereferenced and exposed through the resulting tty file, giving arbitrary kernel-memory disclosure rather than a bounded few-byte leak.\nI:H - The garbage pointer is passed to `tty_kref_get()` \u2192 `refcount_inc()`, a read-modify-write at an attacker-influenced kernel address, followed by further writes in `tty_lock_interruptible()` and `tty_reopen()` (`tty->count++`, ldisc state) \u2014 a memory-corruption primitive usable for control-flow hijacking.\nA:H - The commit documents a kernel NULL-pointer dereference and Oops in `tty_open+0x268/0x6f0`; the wild-pointer dereference reliably panics the kernel, and on the boot path it prevents the system from coming up at all."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "3df6f492f500a16c231f07ccc6f6ed1302caddf9", "versionType": "git"}, {"status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "b79109d6470aaae7062998353e3a19449055829d", "versionType": "git"}, {"status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "953a4a352a0c185460ae1449e4c6e6658e55fdfc", "versionType": "git"}, {"status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "84ea44dc3e4ecb2632586238014bf6722aa5843b", "versionType": "git"}, {"status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "f9d9d25ad1f0d060eaf297a2f7f03b5855a45561", "versionType": "git"}, {"status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "765566110eb0da3cf60198b0165ecceeaafa6444", "versionType": "git"}, {"status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "fcfeaa570f7a5c2d5f4f14931909531ff18b7fde", "versionType": "git"}, {"status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "lessThan": "db4df8e9d79e7d37732c1a1b560958e8dadfefa1", "versionType": "git"}], "programFiles": ["drivers/tty/tty_io.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.28"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.28", "versionType": "semver"}, {"status": "unaffected", "version": "4.14.308", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.276", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.235", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.173", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.100", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.18", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.2.5", "versionType": "semver", "lessThanOrEqual": "6.2.*"}, {"status": "unaffected", "version": "6.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/tty/tty_io.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3df6f492f500a16c231f07ccc6f6ed1302caddf9"}, {"url": "https://git.kernel.org/stable/c/b79109d6470aaae7062998353e3a19449055829d"}, {"url": "https://git.kernel.org/stable/c/953a4a352a0c185460ae1449e4c6e6658e55fdfc"}, {"url": "https://git.kernel.org/stable/c/84ea44dc3e4ecb2632586238014bf6722aa5843b"}, {"url": "https://git.kernel.org/stable/c/f9d9d25ad1f0d060eaf297a2f7f03b5855a45561"}, {"url": "https://git.kernel.org/stable/c/765566110eb0da3cf60198b0165ecceeaafa6444"}, {"url": "https://git.kernel.org/stable/c/fcfeaa570f7a5c2d5f4f14931909531ff18b7fde"}, {"url": "https://git.kernel.org/stable/c/db4df8e9d79e7d37732c1a1b560958e8dadfefa1"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: fix out-of-bounds access in tty_driver_lookup_tty()\n\nWhen specifying an invalid console= device like console=tty3270,\ntty_driver_lookup_tty() returns the tty struct without checking\nwhether index is a valid number.\n\nTo reproduce:\n\nqemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \\\n-kernel ../linux-build-x86/arch/x86/boot/bzImage \\\n-append \"console=ttyS0 console=tty3270\"\n\nThis crashes with:\n\n[ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef\n[ 0.771265] #PF: supervisor read access in kernel mode\n[ 0.771773] #PF: error_code(0x0000) - not-present page\n[ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI\n[ 0.774878] RIP: 0010:tty_open+0x268/0x6f0\n[ 0.784013] chrdev_open+0xbd/0x230\n[ 0.784444] ? cdev_device_add+0x80/0x80\n[ 0.784920] do_dentry_open+0x1e0/0x410\n[ 0.785389] path_openat+0xca9/0x1050\n[ 0.785813] do_filp_open+0xaa/0x150\n[ 0.786240] file_open_name+0x133/0x1b0\n[ 0.786746] filp_open+0x27/0x50\n[ 0.787244] console_on_rootfs+0x14/0x4d\n[ 0.787800] kernel_init_freeable+0x1e4/0x20d\n[ 0.788383] ? rest_init+0xc0/0xc0\n[ 0.788881] kernel_init+0x11/0x120\n[ 0.789356] ret_from_fork+0x22/0x30"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.308", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.276", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.235", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.173", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.100", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.18", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.2.5", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.3", "versionStartIncluding": "2.6.28"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:57.447Z"}}}, "cveMetadata": {"cveId": "CVE-2023-54198", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:41.131Z", "dateReserved": "2025-12-30T12:06:44.499Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-30T12:09:04.229Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/tty/tty_io.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3df6f492f500a16c231f07ccc6f6ed1302caddf9", "status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "versionType": "git"}, {"lessThan": "b79109d6470aaae7062998353e3a19449055829d", "status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "versionType": "git"}, {"lessThan": "953a4a352a0c185460ae1449e4c6e6658e55fdfc", "status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "versionType": "git"}, {"lessThan": "84ea44dc3e4ecb2632586238014bf6722aa5843b", "status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "versionType": "git"}, {"lessThan": "f9d9d25ad1f0d060eaf297a2f7f03b5855a45561", "status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "versionType": "git"}, {"lessThan": "765566110eb0da3cf60198b0165ecceeaafa6444", "status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "versionType": "git"}, {"lessThan": "fcfeaa570f7a5c2d5f4f14931909531ff18b7fde", "status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "versionType": "git"}, {"lessThan": "db4df8e9d79e7d37732c1a1b560958e8dadfefa1", "status": "affected", "version": "99f1fe189daf8e99a847e420567e49dd7ee2aae7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/tty/tty_io.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.28"}, {"lessThan": "2.6.28", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.308", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.276", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.235", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.173", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.100", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.18", "versionType": "semver"}, {"lessThanOrEqual": "6.2.*", "status": "unaffected", "version": "6.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: fix out-of-bounds access in tty_driver_lookup_tty()\n\nWhen specifying an invalid console= device like console=tty3270,\ntty_driver_lookup_tty() returns the tty struct without checking\nwhether index is a valid number.\n\nTo reproduce:\n\nqemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \\\n-kernel ../linux-build-x86/arch/x86/boot/bzImage \\\n-append \"console=ttyS0 console=tty3270\"\n\nThis crashes with:\n\n[ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef\n[ 0.771265] #PF: supervisor read access in kernel mode\n[ 0.771773] #PF: error_code(0x0000) - not-present page\n[ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI\n[ 0.774878] RIP: 0010:tty_open+0x268/0x6f0\n[ 0.784013] chrdev_open+0xbd/0x230\n[ 0.784444] ? cdev_device_add+0x80/0x80\n[ 0.784920] do_dentry_open+0x1e0/0x410\n[ 0.785389] path_openat+0xca9/0x1050\n[ 0.785813] do_filp_open+0xaa/0x150\n[ 0.786240] file_open_name+0x133/0x1b0\n[ 0.786746] filp_open+0x27/0x50\n[ 0.787244] console_on_rootfs+0x14/0x4d\n[ 0.787800] kernel_init_freeable+0x1e4/0x20d\n[ 0.788383] ? rest_init+0xc0/0xc0\n[ 0.788881] kernel_init+0x11/0x120\n[ 0.789356] ret_from_fork+0x22/0x30"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntty: corregir acceso fuera de l\u00edmites en tty_driver_lookup_tty()\n\nAl especificar un dispositivo console= inv\u00e1lido como console=tty3270,\ntty_driver_lookup_tty() devuelve la estructura tty sin verificar\nsi el \u00edndice es un n\u00famero v\u00e1lido.\n\nPara reproducir:\n\nqemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \\\n-kernel .. / linux-build-x86/arch/x86/boot/bzImage \\\n-append \u2019console=ttyS0 console=tty3270\u2019\n\nEsto falla con:\n\n[ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef\n[ 0.771265] #PF: supervisor read access in kernel mode\n[ 0.771773] #PF: error_code(0x0000) - not-present page\n[ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI\n[ 0.774878] RIP: 0010:tty_open+0x268/0x6f0\n[ 0.784013] chrdev_open+0xbd/0x230\n[ 0.784444] ? cdev_device_add+0x80/0x80\n[ 0.784920] do_dentry_open+0x1e0/0x410\n[ 0.785389] path_openat+0xca9/0x1050\n[ 0.785813] do_filp_open+0xaa/0x150\n[ 0.786240] file_open_name+0x133/0x1b0\n[ 0.786746] filp_open+0x27/0x50\n[ 0.787244] console_on_rootfs+0x14/0x4d\n[ 0.787800] kernel_init_freeable+0x1e4/0x20d\n[ 0.788383] ? rest_init+0xc0/0xc0\n[ 0.788881] kernel_init+0x11/0x120\n[ 0.789356] ret_from_fork+0x22/0x30"}], "id": "CVE-2023-54198", "lastModified": "2026-10-28T19:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-54198", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:38:58.741580Z", "version": "2.0.3"}}]}, "published": "2025-12-30T13:16:07.877", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3df6f492f500a16c231f07ccc6f6ed1302caddf9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/765566110eb0da3cf60198b0165ecceeaafa6444"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/84ea44dc3e4ecb2632586238014bf6722aa5843b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/953a4a352a0c185460ae1449e4c6e6658e55fdfc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b79109d6470aaae7062998353e3a19449055829d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/db4df8e9d79e7d37732c1a1b560958e8dadfefa1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f9d9d25ad1f0d060eaf297a2f7f03b5855a45561"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fcfeaa570f7a5c2d5f4f14931909531ff18b7fde"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: tty: fix out-of-bounds access in tty_driver_lookup_tty()", "id": "2426177", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426177"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2023-54198", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-54198\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-54198\nhttps://lore.kernel.org/linux-cve-announce/2025123029-CVE-2023-54198-1df4@gregkh/T"], "threat_severity": "Low"}

{}