CVE-2023-53843
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-53843
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53843.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-53843
- Downstream
- Published
- 2025-12-09T01:30:05.698Z
- Modified
- 2025-12-09T03:12:30.707259Z
- Summary
- net: openvswitch: reject negative ifindex
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: reject negative ifindex
Recent changes in net-next (commit 759ab1edb56c ("net: store netdevs in an xarray")) refactored the handling of pre-assigned ifindexes and let syzbot surface a latent problem in ovs. ovs does not validate ifindex, making it possible to create netdev ports with negative ifindex values. It's easy to repro with YNL:
$ ./cli.py --spec netlink/specs/ovsdatapath.yaml \ --do new \ --json '{"upcall-pid": 1, "name":"my-dp"}' $ ./cli.py --spec netlink/specs/ovsvport.yaml \ --do new \ --json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}'
$ ip link show -65536: some-port0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 7a:48:21:ad:0b:fb brd ff:ff:ff:ff:ff:ff ...
Validate the inputs. Now the second command correctly returns:
$ ./cli.py --spec netlink/specs/ovs_vport.yaml \ --do new \ --json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}'
lib.ynl.NlError: Netlink error: Numerical result out of range nllen = 108 (92) nlflags = 0x300 nl_type = 2 error: -34 extack: {'msg': 'integer out of range', 'unknown': [[type:4 len:36] b'\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\xff\xff\xff\x7f\x00\x00\x00\x00\x08\x00\x01\x00\x08\x00\x00\x00'], 'bad-attr': '.ifindex'}
Accept 0 since it used to be silently ignored.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53843.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/881faff9e548a7ddfb11595be7c1c649217d27db
- https://git.kernel.org/stable/c/a552bfa16bab4ce901ee721346a28c4e483f4066
- https://git.kernel.org/stable/c/c965a58376146dcfdda186819462e8eb3aadef3a
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53843.json
- https://nvd.nist.gov/vuln/detail/CVE-2023-53843
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced54c4ef34c4b6f9720fded620e2893894f9f2c554Fixedc965a58376146dcfdda186819462e8eb3aadef3aFixed881faff9e548a7ddfb11595be7c1c649217d27dbFixeda552bfa16bab4ce901ee721346a28c4e483f4066