CVE-2023-54133

Root

Cause

The vulnerability resides in the Linux kernel's nfp (Netronome Flow Processor) driver. When a network port is closed, the driver cleans multicast (mc) addresses in software state but does not synchronize this removal with the application firmware. As a result, the firmware retains the multicast addresses, leading to a resource leak [1].

Exploitation

An attacker can trigger this issue by moving network devices between namespaces, which causes the port to be closed and reopened. No special privileges beyond the ability to manage network namespaces are required. The leak accumulates over repeated operations, exhausting firmware resources [1].

Impact

A local attacker can exhaust the application firmware's multicast address table, potentially causing denial of service for multicast traffic handling. The leak persists until the system is rebooted or the firmware is reset [1].

Mitigation

The fix, introduced in Linux kernel commit c427221733d49fd1e1b79b4a86746acf3ef660e7, uses __dev_mc_unsync to properly clean multicast addresses from firmware when closing a port. Users should apply the latest stable kernel updates to remediate this issue [1].