CVE-2023-54090

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ixgbe: Fix panic during XDP_TX with > 64 CPUs

Commit 4fe815850bdc ("ixgbe: let the xdpdrv work with more than 64 cpus")

adds support to allow XDP programs to run on systems with more than

64 CPUs by locking the XDP TX rings and indexing them using cpu % 64

(IXGBE_MAX_XDP_QS).

Upon trying this out patch on a system with more than 64 cores,

the kernel paniced with an array-index-out-of-bounds at the return in

ixgbe_determine_xdp_ring in ixgbe.h, which means ixgbe_determine_xdp_q_idx

was just returning the cpu instead of cpu % IXGBE_MAX_XDP_QS. An example

splat:

==========================================================================

UBSAN: array-index-out-of-bounds in

/var/lib/dkms/ixgbe/5.18.6+focal-1/build/src/ixgbe.h:1147:26

index 65 is out of range for type 'ixgbe_ring *[64]'

==========================================================================

BUG: kernel NULL pointer dereference, address: 00000000

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References