CVE-2023-52906

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_mpls: Fix warning during failed attribute validation

The 'TCA_MPLS_LABEL' attribute is of 'NLA_U32' type, but has a

validation type of 'NLA_VALIDATE_FUNCTION'. This is an invalid

combination according to the comment above 'struct nla_policy':

"

Meaning of `validate' field, use via NLA_POLICY_VALIDATE_FN:

NLA_BINARY Validation function called for the attribute.

All other Unused - but note that it's a union

"

This can trigger the warning [1] in nla_get_range_unsigned() when

validation of the attribute fails. Despite being of 'NLA_U32' type, the

associated 'min'/'max' fields in the policy are negative as they are

aliased by the 'validate' field.

Fix by changing the attribute type to 'NLA_BINARY' which is consistent

with the above comment and all other users of NLA_POLICY_VALIDATE_FN().

As a result, move the length validation to the validation function.

No regressions in MPLS

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References