CVE-2023-54031
Description
An out-of-bounds read vulnerability was found in the Linux kernel's vDPA (virtio Data Path Acceleration) netlink interface. The vdpa_nl_policy structure was missing the nla_policy entry for the queue index attribute. Without proper validation, parsing netlink messages with this attribute could result in an invalid nlattr pointer, leading to out-of-bounds memory reads similar to CVE-2023-3773.
Statement
This flaw affects systems using vDPA for virtio device acceleration, typically in virtualization environments. The missing netlink attribute validation allows crafted netlink messages to cause OOB reads. Exploitation requires the ability to send netlink messages to the vDPA subsystem, which typically requires CAP_NET_ADMIN privileges or root access.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
