In the Linux kernel, the following vulnerability has been resolved:
netlink: prevent potential spectre v1 gadgets
Most netlink attributes are parsed and validated from _nlavalidateparse() or validatenla()
u16 type = nla_type(nla);
if (type == 0 || type > maxtype) {
/* error or continue */
}
@type is then used as an array index and can be used as a Spectre v1 gadget.
arrayindexnospec() can be used to prevent leaking content of kernel memory to malicious users.
This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53000.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53000.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@539ca5dcbc91134bbe2c45677811c31d8b030d2d",
"digest": {
"function_hash": "67732047622109775842688020704747003901",
"length": 3611.0
},
"id": "CVE-2023-53000-093517fd",
"deprecated": false,
"target": {
"file": "lib/nlattr.c",
"function": "validate_nla"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@539ca5dcbc91134bbe2c45677811c31d8b030d2d",
"digest": {
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"147655266771331713071085102142690928277",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"197384163915188384233758259692589119603"
],
"threshold": 0.9
},
"id": "CVE-2023-53000-14e1070c",
"deprecated": false,
"target": {
"file": "lib/nlattr.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41b74e95f297ac360ca7ed6bf200100717cb6c45",
"digest": {
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"147655266771331713071085102142690928277",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"197384163915188384233758259692589119603"
],
"threshold": 0.9
},
"id": "CVE-2023-53000-19ba227f",
"deprecated": false,
"target": {
"file": "lib/nlattr.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e5082b1c66c7783fbcd79b5b178573230e528ff",
"digest": {
"function_hash": "317314630272551023603150321709718275995",
"length": 3523.0
},
"id": "CVE-2023-53000-43727ce1",
"deprecated": false,
"target": {
"file": "lib/nlattr.c",
"function": "validate_nla"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41b74e95f297ac360ca7ed6bf200100717cb6c45",
"digest": {
"function_hash": "276334842912462060238070780120234444721",
"length": 3625.0
},
"id": "CVE-2023-53000-56a6dc16",
"deprecated": false,
"target": {
"file": "lib/nlattr.c",
"function": "validate_nla"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@539ca5dcbc91134bbe2c45677811c31d8b030d2d",
"digest": {
"function_hash": "207597488692733928432244476627845166552",
"length": 1093.0
},
"id": "CVE-2023-53000-7d3675b3",
"deprecated": false,
"target": {
"file": "lib/nlattr.c",
"function": "__nla_validate_parse"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41b74e95f297ac360ca7ed6bf200100717cb6c45",
"digest": {
"function_hash": "207597488692733928432244476627845166552",
"length": 1093.0
},
"id": "CVE-2023-53000-8145b4cb",
"deprecated": false,
"target": {
"file": "lib/nlattr.c",
"function": "__nla_validate_parse"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e5082b1c66c7783fbcd79b5b178573230e528ff",
"digest": {
"function_hash": "4319114024994062784562998346296363728",
"length": 932.0
},
"id": "CVE-2023-53000-c74160c3",
"deprecated": false,
"target": {
"file": "lib/nlattr.c",
"function": "__nla_validate_parse"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e5082b1c66c7783fbcd79b5b178573230e528ff",
"digest": {
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"51242149808916695622619263993574615057",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"252753867126881689756920966032532198841"
],
"threshold": 0.9
},
"id": "CVE-2023-53000-f7d88cbf",
"deprecated": false,
"target": {
"file": "lib/nlattr.c"
}
}
]