In the Linux kernel, the following vulnerability has been resolved:
ntbhwswitchtec: Fix shift-out-of-bounds in switchtecntbmwsettrans
There is a kernel API ntbmwcleartrans() would pass 0 to both addr and size. This would make xlatepos negative.
[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntbhwswitchtec.c:293:7 [ 23.734418] shift exponent -1 is negative
Ensuring xlate_pos is a positive or zero before BIT.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ed22f8d8be26225a78cf5e85b2036421a6bf2d5",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"292443880290703572225294448218450297588",
"26757319958389825450585445281854106477",
"271104384088244537398397143153004706977",
"268292259961244253563289829880393556225"
]
},
"target": {
"file": "drivers/ntb/hw/mscc/ntb_hw_switchtec.c"
},
"id": "CVE-2023-53034-cc44e0c1",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ed22f8d8be26225a78cf5e85b2036421a6bf2d5",
"deprecated": false,
"digest": {
"function_hash": "201329879692013296208526547645266460773",
"length": 1440.0
},
"target": {
"function": "switchtec_ntb_mw_set_trans",
"file": "drivers/ntb/hw/mscc/ntb_hw_switchtec.c"
},
"id": "CVE-2023-53034-d0a955dc",
"signature_version": "v1",
"signature_type": "Function"
}
]