CVE-2023-52614

This linux kernel vulnerability occurs in the power management devfreq subsystem, specifically within the trans_stat_show function. The code previously used a basic snprintf call to display state transition statistics, which could trigger a buffer overflow if the resulting transition table was larger than a single memory page limit. Patched kernel versions resolve the issue by replacing the unsafe operation with a securely bounded scnprintf call. Additionally, the fix introduces safety checks to halt the operation early and return an -EFBIG error if the output data exceeds the PAGE_SIZE limit, preventing the memory corruption bug.

This vulnerability is rated as having a Low severity impact because exploiting it requires local access on systems featuring devfreq devices with an exceptionally large number of operational frequency states. Devfreq functionality is primarily targeted at mobile and embedded SoC platforms, which are uncommon in standard Red Hat Enterprise Linux server deployments. Furthermore, exceeding the single-page sysfs output limit requires a rare hardware configuration, significantly limiting the attack surface and potential blast radius.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.