CVE-2023-3773
published 2023-07-25CVE-2023-3773: A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN…
PriorityP419medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.24%
14.7th percentile
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| debian | linux | < linux 6.4.11-1 (forky) | linux 6.4.11-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 13b00b135665c92065a27c0c39dd97e0f380bd4f < 8ad9bc25cbdcec72e7ca43dd8281decb69ea9a70 | 8ad9bc25cbdcec72e7ca43dd8281decb69ea9a70 |
| linux | linux | >= 13b00b135665c92065a27c0c39dd97e0f380bd4f < ccb533b7070aeeb65c66ea5d590e9c62421dcd61 | ccb533b7070aeeb65c66ea5d590e9c62421dcd61 |
| linux | linux | >= 13b00b135665c92065a27c0c39dd97e0f380bd4f < b3003e1b54e057f5f3124e437b80c3bef26ed3fe | b3003e1b54e057f5f3124e437b80c3bef26ed3fe |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.197-1 | 5.10.197-1 |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.13-1 | 6.4.13-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 6.4.13-1 | 6.4.13-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 5.15.0-91.101 | 5.15.0-91.101 |
| linux | linux_kernel | >= 5.15.198 < 6.1.47 | 6.1.47 |
| linux | linux_kernel | >= 5.19.0 < 6.1.47 | 6.1.47 |
| linux | linux_kernel | >= 6.1 < 6.1.47 | 6.1.47 |
| linux | linux_kernel | >= 6.2 < 6.4.12 | 6.4.12 |
| linux | linux_kernel | >= 6.2.0 < 6.4.12 | 6.4.12 |
| linux | linux_kernel | >= 6.4 < 6.4.8 | 6.4.8 |
| msrc | cbl2_hyperv-daemons_5.15.153.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_hyperv-daemons_5.15.158.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
osv4.7MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu4.7MEDIUM
vendor_msrc4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
vendor_redhat·2025-12-24·CVSS 5.5
CVE-2023-54031 [MEDIUM] CWE-125 kernel: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
kernel: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa queue index attr to avoid
such bugs.
An out-of-bounds read vulnerability was found in the Linux kernel's vDPA (virtio Data Path Acceleration) netlink inte
Red Hat
kernel: vdpa: Add features attr to vdpa_nl_policy for nlattr length check
vendor_redhat·2025-10-07·CVSS 5.5
CVE-2023-53652 [MEDIUM] CWE-125 kernel: vdpa: Add features attr to vdpa_nl_policy for nlattr length check
kernel: vdpa: Add features attr to vdpa_nl_policy for nlattr length check
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add features attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa features attr to avoid
such bugs.
Statement: Missing nla_policy for VDPA_ATTR_DEV_FEATURES allowed an unchecked nlattr to pass parsing and be used by handlers,
Red Hat
kernel: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
vendor_redhat·2025-10-04·CVSS 5.5
CVE-2023-53543 [MEDIUM] CWE-125 kernel: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
kernel: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa max vqp attr to avoid
such bugs.
Statement: A missing Netlink policy entry for VDPA_ATTR_DEV_NET_CFG_MAX_VQP allowed malformed Netlink messages to bypass length v
Red Hat
kernel: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
vendor_redhat·2025-10-01·CVSS 5.5
CVE-2023-53516 [MEDIUM] CWE-125 kernel: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
kernel: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
In the Linux kernel, the following vulnerability has been resolved:
macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for
broadcast cutoff") added one additional attribute named
IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff.
However, it forgot to describe the nla_policy at macvlan_policy
(drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer
can be faked as empty (0 bytes) by a malicious user, which could leads
to OOB in heap just like CVE-2023-3773.
To fix it, this commit just completes the nla_policy description for
IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the
potential OOB read.
Statement: The pat
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-01-10·CVSS 4.6
CVE-2023-39192 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsystem in t
Ubuntu
Linux kernel (Intel IoTG) vulnerabilities
vendor_ubuntu·2024-01-05·CVSS 4.6
CVE-2023-39189 [MEDIUM] Linux kernel (Intel IoTG) vulnerabilities
Title: Linux kernel (Intel IoTG) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter s
Ubuntu
Linux kernel (Low Latency) vulnerabilities
vendor_ubuntu·2023-12-13·CVSS 4.6
CVE-2023-5178 [MEDIUM] Linux kernel (Low Latency) vulnerabilities
Title: Linux kernel (Low Latency) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-12-13·CVSS 4.6
CVE-2023-5178 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsystem in t
Ubuntu
Linux kernel (GKE) vulnerabilities
vendor_ubuntu·2023-12-12·CVSS 4.6
CVE-2023-5717 [MEDIUM] Linux kernel (GKE) vulnerabilities
Title: Linux kernel (GKE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsyste
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-12-12·CVSS 4.6
CVE-2023-5158 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsystem in t
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-12-11·CVSS 4.6
CVE-2023-5178 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsystem in t
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-12-05·CVSS 4.6
CVE-2023-5158 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsystem in t
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2023-10-04·CVSS 4.7
CVE-2023-3773 [MEDIUM] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD
processors utilising speculative execution and branch prediction may allow
unauthorised memory reads via a speculative side-channel attack. A local
attacker could use this to expose sensitive information, including kernel
memory. (CVE-2023-20569)
Ivan D Barrera, Christopher Bednarz, Mustafa Ismail, and Shiraz Saleem
discovered that the InfiniBand RDMA driver in the Linux kernel did not
properly check for zero-length STAG or MR registration. A remote attacker
could possibly use this to execute arbitrary code. (CVE-2023-25775)
It was discovered that the USB subsystem in the Linux kernel contained a
race cond
Red Hat
kernel: xfrm: out-of-bounds read of XFRMA_MTIMER_THRESH nlattr
vendor_redhat·2023-07-23·CVSS 5.5
CVE-2023-3773 [MEDIUM] CWE-125 kernel: xfrm: out-of-bounds read of XFRMA_MTIMER_THRESH nlattr
kernel: xfrm: out-of-bounds read of XFRMA_MTIMER_THRESH nlattr
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Ente
Microsoft
Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr
vendor_msrc·2023-07-11·CVSS 4.4
CVE-2023-3773 [MEDIUM] CWE-125 Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr
Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: http
Debian
CVE-2023-3773: linux - A flaw was found in the Linux kernel’s IP framework for transforming packets (XF...
vendor_debian·2023·CVSS 5.5
CVE-2023-3773 [MEDIUM] CVE-2023-3773: linux - A flaw was found in the Linux kernel’s IP framework for transforming packets (XF...
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
Scope: local
bookworm: resolved (fixed in 6.1.52-1)
bullseye: resolved (fixed in 5.10.197-1)
forky: resolved (fixed in 6.4.13-1)
sid: resolved (fixed in 6.4.13-1)
trixie: resolved (fixed in 6.4.13-1)
Debian
CVE-2023-53516: linux - In the Linux kernel, the following vulnerability has been resolved: macvlan: ad...
vendor_debian·2023·CVSS 5.5
CVE-2023-53516 [MEDIUM] CVE-2023-53516: linux - In the Linux kernel, the following vulnerability has been resolved: macvlan: ad...
In the Linux kernel, the following vulnerability has been resolved: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff") added one additional attribute named IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff. However, it forgot to describe the nla_policy at macvlan_policy (drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer can be faked as empty (0 bytes) by a malicious user, which could leads to OOB in heap just like CVE-2023-3773. To fix it, this commit just completes the nla_policy description for IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the potential OOB read.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.4.11-1)
si
Debian
CVE-2023-53652: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa: Add f...
vendor_debian·2023·CVSS 5.5
CVE-2023-53652 [MEDIUM] CVE-2023-53652: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa: Add f...
In the Linux kernel, the following vulnerability has been resolved: vdpa: Add features attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.
Scope: local
bookworm: resolved (fixed in 6.1.52-1)
bullseye: resolved
forky: resolved (fixed in 6.4.13-1)
sid: resolved (fixed in 6.4.13-1)
trixie: resolved (fixed in 6.4.13-1)
Debian
CVE-2023-53543: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa: Add m...
vendor_debian·2023·CVSS 5.5
CVE-2023-53543 [MEDIUM] CVE-2023-53543: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa: Add m...
In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.
Scope: local
bookworm: resolved (fixed in 6.1.52-1)
bullseye: resolved
forky: resolved (fixed in 6.4.13-1)
sid: resolved (fixed in 6.4.13-1)
trixie: resolved (fixed in 6.4.13-1)
Debian
CVE-2023-54031: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa: Add q...
vendor_debian·2023·CVSS 5.5
CVE-2023-54031 [MEDIUM] CVE-2023-54031: linux - In the Linux kernel, the following vulnerability has been resolved: vdpa: Add q...
In the Linux kernel, the following vulnerability has been resolved: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa queue index attr to avoid such bugs.
Scope: local
bookworm: resolved (fixed in 6.1.52-1)
bullseye: resolved
forky: resolved (fixed in 6.4.13-1)
sid: resolved (fixed in 6.4.13-1)
trixie: resolved (fixed in 6.4.13-1)
GHSA
GHSA-8vph-jw2x-79f2: In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
The vdpa_nl
ghsa_unreviewed·2025-12-24·CVSS 5.5
CVE-2023-54031 [MEDIUM] GHSA-8vph-jw2x-79f2: In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
The vdpa_nl
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa queue index attr to avoid
such bugs.
OSV
CVE-2023-54031: In the Linux kernel, the following vulnerability has been resolved: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check The vdpa_nl_p
osv·2025-12-24·CVSS 4.4
CVE-2023-54031 [MEDIUM] CVE-2023-54031: In the Linux kernel, the following vulnerability has been resolved: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check The vdpa_nl_p
In the Linux kernel, the following vulnerability has been resolved: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa queue index attr to avoid such bugs.
OSV
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
osv·2025-12-24·CVSS 4.4
CVE-2023-54031 [MEDIUM] vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa queue index attr to avoid
such bugs.
OSV
CVE-2023-53652: In the Linux kernel, the following vulnerability has been resolved: vdpa: Add features attr to vdpa_nl_policy for nlattr length check The vdpa_nl_poli
osv·2025-10-07·CVSS 4.4
CVE-2023-53652 [MEDIUM] CVE-2023-53652: In the Linux kernel, the following vulnerability has been resolved: vdpa: Add features attr to vdpa_nl_policy for nlattr length check The vdpa_nl_poli
In the Linux kernel, the following vulnerability has been resolved: vdpa: Add features attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.
GHSA
GHSA-j5px-w2f8-7x3g: In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add features attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_po
ghsa_unreviewed·2025-10-07·CVSS 5.5
CVE-2023-53652 [MEDIUM] CWE-787 GHSA-j5px-w2f8-7x3g: In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add features attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_po
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add features attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa features attr to avoid
such bugs.
OSV
CVE-2023-53543: In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_polic
osv·2025-10-04·CVSS 4.4
CVE-2023-53543 [MEDIUM] CVE-2023-53543: In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_polic
In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.
GHSA
GHSA-5ww6-4m54-3jr9: In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_pol
ghsa_unreviewed·2025-10-04·CVSS 5.5
CVE-2023-53543 [MEDIUM] CWE-787 GHSA-5ww6-4m54-3jr9: In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_pol
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa max vqp attr to avoid
such bugs.
GHSA
GHSA-m235-57qr-6fh8: In the Linux kernel, the following vulnerability has been resolved:
macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
The previous commit
ghsa_unreviewed·2025-10-01·CVSS 5.5
CVE-2023-53516 [MEDIUM] CWE-787 GHSA-m235-57qr-6fh8: In the Linux kernel, the following vulnerability has been resolved:
macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
The previous commit
In the Linux kernel, the following vulnerability has been resolved:
macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for
broadcast cutoff") added one additional attribute named
IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff.
However, it forgot to describe the nla_policy at macvlan_policy
(drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer
can be faked as empty (0 bytes) by a malicious user, which could leads
to OOB in heap just like CVE-2023-3773.
To fix it, this commit just completes the nla_policy description for
IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the
potential OOB read.
OSV
CVE-2023-53516: In the Linux kernel, the following vulnerability has been resolved: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF The previous commit 9
osv·2025-10-01·CVSS 4.4
CVE-2023-53516 [MEDIUM] CVE-2023-53516: In the Linux kernel, the following vulnerability has been resolved: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF The previous commit 9
In the Linux kernel, the following vulnerability has been resolved: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff") added one additional attribute named IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff. However, it forgot to describe the nla_policy at macvlan_policy (drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer can be faked as empty (0 bytes) by a malicious user, which could leads to OOB in heap just like CVE-2023-3773. To fix it, this commit just completes the nla_policy description for IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the potential OOB read.
OSV
linux-gcp-5.15, linux-intel-iotg-5.15 vulnerabilities
osv·2024-01-10·CVSS 4.6
CVE-2023-37453 [MEDIUM] linux-gcp-5.15, linux-intel-iotg-5.15 vulnerabilities
linux-gcp-5.15, linux-intel-iotg-5.15 vulnerabilities
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate some a
OSV
linux-intel-iotg vulnerabilities
osv·2024-01-05·CVSS 4.6
CVE-2023-37453 [MEDIUM] linux-intel-iotg vulnerabilities
linux-intel-iotg vulnerabilities
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate some attributes passed from
OSV
linux-hwe-6.2, linux-lowlatency-hwe-6.2, linux-nvidia-6.2 vulnerabilities
osv·2023-12-13·CVSS 4.6
CVE-2023-37453 [MEDIUM] linux-hwe-6.2, linux-lowlatency-hwe-6.2, linux-nvidia-6.2 vulnerabilities
linux-hwe-6.2, linux-lowlatency-hwe-6.2, linux-nvidia-6.2 vulnerabilities
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not prop
OSV
linux-lowlatency, linux-lowlatency-hwe-5.15 vulnerabilities
osv·2023-12-13·CVSS 4.6
CVE-2023-37453 [MEDIUM] linux-lowlatency, linux-lowlatency-hwe-5.15 vulnerabilities
linux-lowlatency, linux-lowlatency-hwe-5.15 vulnerabilities
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate
OSV
linux-gkeop, linux-gkeop-5.15 vulnerabilities
osv·2023-12-12·CVSS 4.6
CVE-2023-37453 [MEDIUM] linux-gkeop, linux-gkeop-5.15 vulnerabilities
linux-gkeop, linux-gkeop-5.15 vulnerabilities
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate some attribute
OSV
linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gke, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-nvidia, linux-
osv·2023-12-11·CVSS 4.6
[MEDIUM] linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gke, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-nvidia, linux-
linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gke, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of s
OSV
linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2, linux-azure-fde-6.2, linux-lowlatency, linux-oracle, linux-raspi, linux-starfive vulnerabilities
osv·2023-12-05·CVSS 4.6
CVE-2023-37453 [MEDIUM] linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2, linux-azure-fde-6.2, linux-lowlatency, linux-oracle, linux-raspi, linux-starfive vulnerabilities
linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2, linux-azure-fde-6.2, linux-lowlatency, linux-oracle, linux-raspi, linux-starfive vulnerabilities
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
OSV
linux-oem-6.1 vulnerabilities
osv·2023-10-04·CVSS 4.7
CVE-2023-20569 [MEDIUM] linux-oem-6.1 vulnerabilities
linux-oem-6.1 vulnerabilities
Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD
processors utilising speculative execution and branch prediction may allow
unauthorised memory reads via a speculative side-channel attack. A local
attacker could use this to expose sensitive information, including kernel
memory. (CVE-2023-20569)
Ivan D Barrera, Christopher Bednarz, Mustafa Ismail, and Shiraz Saleem
discovered that the InfiniBand RDMA driver in the Linux kernel did not
properly check for zero-length STAG or MR registration. A remote attacker
could possibly use this to execute arbitrary code. (CVE-2023-25775)
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a ou
Kernel
vdpa: Add features attr to vdpa_nl_policy for nlattr length check
kernel_security·2023-07-27·CVSS 5.5
CVE-2023-3773 [MEDIUM] vdpa: Add features attr to vdpa_nl_policy for nlattr length check
vdpa: Add features attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa features attr to avoid
such bugs.
Fixes: 90fea5a800c3 ("vdpa: device feature provisioning")
Signed-off-by: Lin Ma
Cc: [email protected]
Message-Id:
Signed-off-by: Michael S. Tsirkin
Kernel
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
kernel_security·2023-07-27·CVSS 5.5
CVE-2023-3773 [MEDIUM] vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa max vqp attr to avoid
such bugs.
Fixes: ad69dd0bf26b ("vdpa: Introduce query of device config layout")
Signed-off-by: Lin Ma
Cc: [email protected]
Message-Id:
Signed-off-by: Michael S. Tsirkin
Kernel
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
kernel_security·2023-07-27·CVSS 5.5
CVE-2023-3773 [MEDIUM] vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa queue index attr to avoid
such bugs.
Fixes: 13b00b135665 ("vdpa: Add support for querying vendor statistics")
Signed-off-by: Lin Ma
Cc: [email protected]
Message-Id:
Signed-off-by: Michael S. Tsirkin
OSV
CVE-2023-3773: A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem)
osv·2023-07-25·CVSS 4.4
CVE-2023-3773 [MEDIUM] CVE-2023-3773: A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem)
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
GHSA
GHSA-2m35-m4g6-x835: A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem)
ghsa_unreviewed·2023-07-25
CVE-2023-3773 [MEDIUM] CWE-125 GHSA-2m35-m4g6-x835: A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem)
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
Kernel
xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
kernel_security·2023-07-23·CVSS 5.5
CVE-2023-3773 [MEDIUM] xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
The previous commit 4e484b3e969b ("xfrm: rate limit SA mapping change
message to user space") added one additional attribute named
XFRMA_MTIMER_THRESH and described its type at compat_policy
(net/xfrm/xfrm_compat.c).
However, the author forgot to also describe the nla_policy at
xfrma_policy (net/xfrm/xfrm_user.c). Hence, this suppose NLA_U32 (4
bytes) value can be faked as empty (0 bytes) by a malicious user, which
leads to 4 bytes overflow read and heap information leak when parsing
nlattrs.
To exploit this, one malicious user can spray the SLUB objects and then
leverage this 4 bytes OOB read to leak the heap data into
x->mapping_maxage (see xfrm_update_ae_params(...)), and leak it to
userspace via copy_to_user_state_extra(...).
T
Kernel
macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
kernel_security·2023-07-23·CVSS 5.5
CVE-2023-3773 [MEDIUM] macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for
broadcast cutoff") added one additional attribute named
IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff.
However, it forgot to describe the nla_policy at macvlan_policy
(drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer
can be faked as empty (0 bytes) by a malicious user, which could leads
to OOB in heap just like CVE-2023-3773.
To fix it, this commit just completes the nla_policy description for
IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the
potential OOB read.
Fixes: 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff")
Signed-off-by: Lin Ma
Reviewed-by: Simon Horman
Link: https://lore.kernel.org
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-54031 kernel: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
bugzilla·2025-12-24·CVSS 4.4
CVE-2023-54031 [MEDIUM] CVE-2023-54031 kernel: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
CVE-2023-54031 kernel: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa queue index attr to avoid
such bugs.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025122437-CVE-2023-540
Bugzilla
CVE-2023-53652 kernel: vdpa: Add features attr to vdpa_nl_policy for nlattr length check
bugzilla·2025-10-07·CVSS 4.4
CVE-2023-53652 [MEDIUM] CVE-2023-53652 kernel: vdpa: Add features attr to vdpa_nl_policy for nlattr length check
CVE-2023-53652 kernel: vdpa: Add features attr to vdpa_nl_policy for nlattr length check
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add features attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa features attr to avoid
such bugs.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025100719-CVE-2023-53652-d67a@g
Bugzilla
CVE-2023-53543 kernel: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
bugzilla·2025-10-04·CVSS 4.4
CVE-2023-53543 [MEDIUM] CVE-2023-53543 kernel: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
CVE-2023-53543 kernel: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa max vqp attr to avoid
such bugs.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025100445-CVE-2023-53543-227c@greg
Bugzilla
CVE-2023-53516 kernel: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
bugzilla·2025-10-01·CVSS 4.4
CVE-2023-53516 [MEDIUM] CVE-2023-53516 kernel: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
CVE-2023-53516 kernel: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
In the Linux kernel, the following vulnerability has been resolved:
macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for
broadcast cutoff") added one additional attribute named
IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff.
However, it forgot to describe the nla_policy at macvlan_policy
(drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer
can be faked as empty (0 bytes) by a malicious user, which could leads
to OOB in heap just like CVE-2023-3773.
To fix it, this commit just completes the nla_policy description for
IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the
potential OOB read.
Bugzilla
CVE-2023-3773 kernel: xfrm: out-of-bounds read of XFRMA_MTIMER_THRESH nlattr
bugzilla·2023-06-30·CVSS 4.4
CVE-2023-3773 [MEDIUM] CVE-2023-3773 kernel: xfrm: out-of-bounds read of XFRMA_MTIMER_THRESH nlattr
CVE-2023-3773 kernel: xfrm: out-of-bounds read of XFRMA_MTIMER_THRESH nlattr
========== 2. OOB read of XFRMA_MTIMER_THRESH nlattr ==========
[require privilege]: CAP_NET_ADMIN
[effects]: information leak
[crash stack]:
Interesting enough as this OOB read will not be detected by KASan (perhaps why this bug is not detected by the fuzzer), see the details below.
[buggy commit]:
4e484b3e969b ("xfrm: rate limit SA mapping change message to user space")
[root cause]:
The mentioned commit above added one additional attribute named XFRMA_MTIMER_THRESH and described its type at compat_policy (net/xfrm/xfrm_compat.c). However, the author forgot to also describe it at xfrma_policy (net/xfrm/xfrm_user.c). Hence, this suppose NLA_U32 (4 bytes) value can be faked as empty (0 bytes) by a malicious
Wiz
CVE-2023-54031 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.5
CVE-2023-54031 [MEDIUM] CVE-2023-54031 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-54031 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa queue index attr to avoid
such bugs.
Source : NVD
Published December 24, 2025
CNA Score N/A
Affected Technologies
Linux Kernel
Linux Debian
Has Publi
https://access.redhat.com/errata/RHSA-2023:6583https://access.redhat.com/security/cve/CVE-2023-3773https://bugzilla.redhat.com/show_bug.cgi?id=2218944https://access.redhat.com/errata/RHSA-2023:6583https://access.redhat.com/security/cve/CVE-2023-3773https://bugzilla.redhat.com/show_bug.cgi?id=2218944https://lists.debian.org/debian-lts-announce/2023/10/msg00027.htmlhttps://www.debian.org/security/2023/dsa-5492
2023-07-25
Published