CVE-2023-53659

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

iavf: Fix out-of-bounds when setting channels on remove

If we set channels greater during iavf_remove(), and waiting reset done

would be timeout, then returned with error but changed num_active_queues

directly, that will lead to OOB like the following logs. Because the

num_active_queues is greater than tx/rx_rings[] allocated actually.

Reproducer:

[root@host ~]# cat repro.sh

#!/bin/bash

pf_dbsf="0000:41:00.0"

vf0_dbsf="0000:41:02.0"

g_pids=()

function do_set_numvf()

{

echo 2 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs

sleep $((RANDOM%3+1))

echo 0 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs

sleep $((RANDOM%3+1))

}

function do_set_channel()

{

local nic=$(ls -1 --indicator-style=none /sys/bus/pci/devices/${vf0_dbsf}/net/)

[ -z "$nic" ] && { sleep $((RANDOM%3)) ; return 1; }

ifconfig $nic 192.168.18.5 netmask 255.255.255.0

ifconfig $nic up

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References