CVE-2023-54031

Vulnerability

In the Linux kernel's vdpa subsystem, the vdpa_nl_policy structure lacked an entry for the queue index attribute. This missing policy meant that the attribute was not properly validated during netlink message parsing, potentially allowing an out-of-bounds (OOB) read similar to CVE-2023-3773 [1].

Exploitation

An attacker could send a specially crafted netlink message to the vdpa interface. The missing nla_policy would cause the kernel to process an invalid nlattr pointer, leading to an OOB read. The attack requires access to the vdpa netlink interface, which typically requires privileges but may be exposed in certain configurations.

Impact

A successful OOB read could leak sensitive kernel memory, potentially exposing confidential data or aiding in further exploitation. The vulnerability does not provide write access, but information disclosure can be a stepping stone for more severe attacks.

Mitigation

The fix adds the appropriate nla_policy for the queue index attribute to vdpa_nl_policy, ensuring proper length checks are performed. The patch has been merged into the Linux kernel stable tree [1]. Users should update to a kernel version containing this commit.