222 lines
12 KiB
JSON
222 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-53495",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-10-01T11:39:39.403Z",
|
|
"datePublished": "2025-10-01T11:45:46.877Z",
|
|
"dateUpdated": "2026-08-05T09:14:27.541Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T09:14:27.541Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()\n\nrules is allocated in ethtool_get_rxnfc and the size is determined by\nrule_cnt from user space. So rule_cnt needs to be check before using\nrules to avoid OOB writing or NULL pointer dereference."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerability is reached through the `SIOCETHTOOL` ioctl on a local socket (`dev_ioctl` → `dev_ethtool` → `mvpp2_ethtool_get_rxnfc`), requiring a local process on the system. No remote or adjacent-network input reaches this code path.\nAC:L - The attacker fully controls `info.rule_cnt` and can deterministically choose the undersized (or NULL) buffer; there is no race, no secret to guess, and no memory-layout dependency, and `queue_mode` defaults to the multi-queue mode that enables the path. The only precondition is a persistent, standard ntuple flow-steering configuration, after which the attack succeeds 100% of the time and can be repeated at will.\nPR:L - `ETHTOOL_GRXCLSRLALL` is explicitly listed in `__dev_ethtool()`'s \"Allow some commands to be done by anyone\" whitelist, so it bypasses the `ns_capable(net->user_ns, CAP_NET_ADMIN)` check — any unprivileged local user, including one confined to a sandbox or container, can invoke it. Only a basic local account is needed, not root or CAP_NET_ADMIN.\nUI:N - The attacker performs the entire attack with a single ioctl from their own process; no victim action is required at attack time. The pre-existing ntuple rule configuration is ambient system state, not an interaction the attacker must induce.\nS:U - The out-of-bounds write corrupts kernel slab memory within the same kernel security authority, and the resulting RTNL deadlock/panic affects the same OS instance. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a heap out-of-bounds write into adjacent `kmalloc-8`/`kmalloc-16` objects reachable by any unprivileged user, and such slab corruption — including of SLUB freelist pointers and neighbouring length/index fields — can be groomed via userspace heap spraying into a kernel memory disclosure primitive. Per kernel scoring guidance, memory corruption leverageable for info disclosure is scored High.\nI:H - `rules[loc++] = i` writes up to 16 bytes into an attacker-sized 4/8/12-byte allocation, a genuine out-of-bounds slab write that lets the attacker overwrite fields of adjacent heap objects. Out-of-bounds writes are scored High as they are the classic basis for control-flow hijacking and privilege escalation.\nA:H - With `rule_cnt = 0` the driver writes through a NULL `rule_buf`, causing an immediate kernel oops, and the OOB variant corrupts slab freelists leading to later crashes. Because `dev_ethtool()` holds `rtnl_lock()` across the call, the oops leaves RTNL permanently held — wedging all networking configuration system-wide with unkillable D-state tasks, or panicking outright on the `panic_on_oops` appliance/embedded systems typical of mvpp2 hardware."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "90b509b39ac9b09be88eb641c7a3abd8de06b698",
|
|
"lessThan": "ba6673824efa3dc198b04a54e69dce480066d7d9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "90b509b39ac9b09be88eb641c7a3abd8de06b698",
|
|
"lessThan": "61054a8ddb176b155a8f2bacdfefb3727187f5d9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "90b509b39ac9b09be88eb641c7a3abd8de06b698",
|
|
"lessThan": "5bb09dddc724c5f7c4dc6dd3bfebd685eecd93e8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "90b509b39ac9b09be88eb641c7a3abd8de06b698",
|
|
"lessThan": "349638f7e5d3c7d328565587bb7b0454bbee02e2",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "90b509b39ac9b09be88eb641c7a3abd8de06b698",
|
|
"lessThan": "625b70d31dd4df4b96b3ddcbe251debb33bd67f5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "90b509b39ac9b09be88eb641c7a3abd8de06b698",
|
|
"lessThan": "51fe0a470543f345e3c62b6798929de3ddcedc1d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.257",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.195",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.132",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.54",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.5.4",
|
|
"lessThanOrEqual": "6.5.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "5.4.257"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "5.10.195"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "5.15.132"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "6.1.54"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "6.5.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.2",
|
|
"versionEndExcluding": "6.6"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ba6673824efa3dc198b04a54e69dce480066d7d9"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/61054a8ddb176b155a8f2bacdfefb3727187f5d9"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5bb09dddc724c5f7c4dc6dd3bfebd685eecd93e8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/349638f7e5d3c7d328565587bb7b0454bbee02e2"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/625b70d31dd4df4b96b3ddcbe251debb33bd67f5"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/51fe0a470543f345e3c62b6798929de3ddcedc1d"
|
|
}
|
|
],
|
|
"title": "net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |