In the Linux kernel, the following vulnerability has been resolved:
netlink: prevent potential spectre v1 gadgets
Most netlink attributes are parsed and validated from _nlavalidateparse() or validatenla()
u16 type = nla_type(nla);
if (type == 0 || type > maxtype) {
/* error or continue */
}
@type is then used as an array index and can be used as a Spectre v1 gadget.
arrayindexnospec() can be used to prevent leaking content of kernel memory to malicious users.
This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions.
[
{
"deprecated": false,
"id": "CVE-2023-53000-093517fd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@539ca5dcbc91134bbe2c45677811c31d8b030d2d",
"digest": {
"function_hash": "67732047622109775842688020704747003901",
"length": 3611.0
},
"target": {
"function": "validate_nla",
"file": "lib/nlattr.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-14e1070c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@539ca5dcbc91134bbe2c45677811c31d8b030d2d",
"digest": {
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"147655266771331713071085102142690928277",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"197384163915188384233758259692589119603"
],
"threshold": 0.9
},
"target": {
"file": "lib/nlattr.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-19ba227f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41b74e95f297ac360ca7ed6bf200100717cb6c45",
"digest": {
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"147655266771331713071085102142690928277",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"197384163915188384233758259692589119603"
],
"threshold": 0.9
},
"target": {
"file": "lib/nlattr.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-43727ce1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e5082b1c66c7783fbcd79b5b178573230e528ff",
"digest": {
"function_hash": "317314630272551023603150321709718275995",
"length": 3523.0
},
"target": {
"function": "validate_nla",
"file": "lib/nlattr.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-4d3d71c9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@992e4ff7116a77968039277b5d6aaa535c2f2184",
"digest": {
"function_hash": "207597488692733928432244476627845166552",
"length": 1093.0
},
"target": {
"function": "__nla_validate_parse",
"file": "lib/nlattr.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-56a6dc16",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41b74e95f297ac360ca7ed6bf200100717cb6c45",
"digest": {
"function_hash": "276334842912462060238070780120234444721",
"length": 3625.0
},
"target": {
"function": "validate_nla",
"file": "lib/nlattr.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-67f07dbe",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0950402e8c76e7dcb08563f1b4e8000fbc62455",
"digest": {
"function_hash": "207597488692733928432244476627845166552",
"length": 1093.0
},
"target": {
"function": "__nla_validate_parse",
"file": "lib/nlattr.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-7ac86869",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@992e4ff7116a77968039277b5d6aaa535c2f2184",
"digest": {
"function_hash": "276334842912462060238070780120234444721",
"length": 3625.0
},
"target": {
"function": "validate_nla",
"file": "lib/nlattr.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-7d3675b3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@539ca5dcbc91134bbe2c45677811c31d8b030d2d",
"digest": {
"function_hash": "207597488692733928432244476627845166552",
"length": 1093.0
},
"target": {
"function": "__nla_validate_parse",
"file": "lib/nlattr.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-8145b4cb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41b74e95f297ac360ca7ed6bf200100717cb6c45",
"digest": {
"function_hash": "207597488692733928432244476627845166552",
"length": 1093.0
},
"target": {
"function": "__nla_validate_parse",
"file": "lib/nlattr.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-9440b3f5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@992e4ff7116a77968039277b5d6aaa535c2f2184",
"digest": {
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"147655266771331713071085102142690928277",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"197384163915188384233758259692589119603"
],
"threshold": 0.9
},
"target": {
"file": "lib/nlattr.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-bf06af35",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0950402e8c76e7dcb08563f1b4e8000fbc62455",
"digest": {
"function_hash": "276334842912462060238070780120234444721",
"length": 3625.0
},
"target": {
"function": "validate_nla",
"file": "lib/nlattr.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-c74160c3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e5082b1c66c7783fbcd79b5b178573230e528ff",
"digest": {
"function_hash": "4319114024994062784562998346296363728",
"length": 932.0
},
"target": {
"function": "__nla_validate_parse",
"file": "lib/nlattr.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-e09034cb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0950402e8c76e7dcb08563f1b4e8000fbc62455",
"digest": {
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"147655266771331713071085102142690928277",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"197384163915188384233758259692589119603"
],
"threshold": 0.9
},
"target": {
"file": "lib/nlattr.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53000-f7d88cbf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e5082b1c66c7783fbcd79b5b178573230e528ff",
"digest": {
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"51242149808916695622619263993574615057",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"252753867126881689756920966032532198841"
],
"threshold": 0.9
},
"target": {
"file": "lib/nlattr.c"
},
"signature_type": "Line",
"signature_version": "v1"
}
]