In the Linux kernel, the following vulnerability has been resolved:
netlink: prevent potential spectre v1 gadgets
Most netlink attributes are parsed and validated from _nlavalidateparse() or validatenla()
u16 type = nla_type(nla);
if (type == 0 || type > maxtype) {
/* error or continue */
}
@type is then used as an array index and can be used as a Spectre v1 gadget.
arrayindexnospec() can be used to prevent leaking content of kernel memory to malicious users.
This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53000.json",
"cna_assigner": "Linux"
}[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@539ca5dcbc91134bbe2c45677811c31d8b030d2d",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "lib/nlattr.c",
"function": "validate_nla"
},
"digest": {
"length": 3611.0,
"function_hash": "67732047622109775842688020704747003901"
},
"signature_version": "v1",
"id": "CVE-2023-53000-093517fd"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@539ca5dcbc91134bbe2c45677811c31d8b030d2d",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "lib/nlattr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"147655266771331713071085102142690928277",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"197384163915188384233758259692589119603"
]
},
"signature_version": "v1",
"id": "CVE-2023-53000-14e1070c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41b74e95f297ac360ca7ed6bf200100717cb6c45",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "lib/nlattr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"147655266771331713071085102142690928277",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"197384163915188384233758259692589119603"
]
},
"signature_version": "v1",
"id": "CVE-2023-53000-19ba227f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e5082b1c66c7783fbcd79b5b178573230e528ff",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "lib/nlattr.c",
"function": "validate_nla"
},
"digest": {
"length": 3523.0,
"function_hash": "317314630272551023603150321709718275995"
},
"signature_version": "v1",
"id": "CVE-2023-53000-43727ce1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@992e4ff7116a77968039277b5d6aaa535c2f2184",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "lib/nlattr.c",
"function": "__nla_validate_parse"
},
"digest": {
"length": 1093.0,
"function_hash": "207597488692733928432244476627845166552"
},
"signature_version": "v1",
"id": "CVE-2023-53000-4d3d71c9"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41b74e95f297ac360ca7ed6bf200100717cb6c45",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "lib/nlattr.c",
"function": "validate_nla"
},
"digest": {
"length": 3625.0,
"function_hash": "276334842912462060238070780120234444721"
},
"signature_version": "v1",
"id": "CVE-2023-53000-56a6dc16"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0950402e8c76e7dcb08563f1b4e8000fbc62455",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "lib/nlattr.c",
"function": "__nla_validate_parse"
},
"digest": {
"length": 1093.0,
"function_hash": "207597488692733928432244476627845166552"
},
"signature_version": "v1",
"id": "CVE-2023-53000-67f07dbe"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@992e4ff7116a77968039277b5d6aaa535c2f2184",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "lib/nlattr.c",
"function": "validate_nla"
},
"digest": {
"length": 3625.0,
"function_hash": "276334842912462060238070780120234444721"
},
"signature_version": "v1",
"id": "CVE-2023-53000-7ac86869"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@539ca5dcbc91134bbe2c45677811c31d8b030d2d",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "lib/nlattr.c",
"function": "__nla_validate_parse"
},
"digest": {
"length": 1093.0,
"function_hash": "207597488692733928432244476627845166552"
},
"signature_version": "v1",
"id": "CVE-2023-53000-7d3675b3"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41b74e95f297ac360ca7ed6bf200100717cb6c45",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "lib/nlattr.c",
"function": "__nla_validate_parse"
},
"digest": {
"length": 1093.0,
"function_hash": "207597488692733928432244476627845166552"
},
"signature_version": "v1",
"id": "CVE-2023-53000-8145b4cb"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@992e4ff7116a77968039277b5d6aaa535c2f2184",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "lib/nlattr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"147655266771331713071085102142690928277",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"197384163915188384233758259692589119603"
]
},
"signature_version": "v1",
"id": "CVE-2023-53000-9440b3f5"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0950402e8c76e7dcb08563f1b4e8000fbc62455",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "lib/nlattr.c",
"function": "validate_nla"
},
"digest": {
"length": 3625.0,
"function_hash": "276334842912462060238070780120234444721"
},
"signature_version": "v1",
"id": "CVE-2023-53000-bf06af35"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e5082b1c66c7783fbcd79b5b178573230e528ff",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "lib/nlattr.c",
"function": "__nla_validate_parse"
},
"digest": {
"length": 932.0,
"function_hash": "4319114024994062784562998346296363728"
},
"signature_version": "v1",
"id": "CVE-2023-53000-c74160c3"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0950402e8c76e7dcb08563f1b4e8000fbc62455",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "lib/nlattr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"147655266771331713071085102142690928277",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"197384163915188384233758259692589119603"
]
},
"signature_version": "v1",
"id": "CVE-2023-53000-e09034cb"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e5082b1c66c7783fbcd79b5b178573230e528ff",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "lib/nlattr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"181863181684512566621651406686765472480",
"92012718167072513710188130532218761535",
"67362368994487627372901657929209706514",
"109947286793721329692601544888352491450",
"159178862699872650036649775095160723328",
"24196351253040958810198185667947048491",
"51242149808916695622619263993574615057",
"96288955809784837714138984484732508467",
"136051403530395333764186127547079259209",
"125404927409994950407611382882704675820",
"252753867126881689756920966032532198841"
]
},
"signature_version": "v1",
"id": "CVE-2023-53000-f7d88cbf"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53000.json"