CVE-2023-54149
Description
A suspicious RCU usage warning was found in the Linux kernel's DSA (Distributed Switch Architecture) networking subsystem. When synchronizing VLAN-aware MAC addresses, vlan_for_each() is called from ndo_set_rx_mode() without holding rtnl_lock(). This violates the locking requirements of vlan_for_each() and leaves the VLAN list unprotected from concurrent modifications.
Statement
This flaw affects specific DSA switch configurations using the felix driver as a DSA master with VLAN-aware bridging. The warning indicates a potential race condition where the VLAN list could be modified while being traversed. While primarily manifesting as a lockdep warning, the underlying race could lead to list corruption in concurrent scenarios.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 7.5 |
| Attack Vector | Local | N/A | Adjacent Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
