CVE-2023-53541

A buffer overflow vulnerability was found in the Linux kernel's Broadcom NAND controller driver when writing out-of-band data. When the OOB buffer length isn't a multiple of word size, the write function performs an out-of-bounds read on the source buffer during its final iteration. This can read beyond allocated memory and potentially cause memory corruption or crashes, resulting in denial of service.

NAND flash uses OOB (out-of-band) areas to store metadata like error correction codes alongside the main data. The Broadcom NAND driver's OOB write function processes this data in word-sized chunks for efficiency. However, when the OOB buffer size isn't evenly divisible by the word size, the final iteration of the write loop doesn't have a full word of data available. The code still attempts to read a complete word from the source buffer, reading past the buffer's end into whatever memory happens to follow it. Depending on what lies beyond the buffer, this could read uninitialized memory, crash due to page faults, or incorporate garbage values into the OOB data written to flash. The fix adds explicit length checks and pads with 0xff (the NAND erase value) when reaching the buffer end. This primarily affects systems using Broadcom NAND controllers with OOB operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.