CVE-2023-53340

An out-of-bounds write vulnerability exists in the linux kernel, such that when DEVX issues a general command not used by the mlx5 driver, the mlx5 is trying to collect the failure data, However, mlx5 doesn't create a storage for this command, leading to an array-index-out-of-bounds error.

This vulnerability is rated as Moderate impact because successful exploitation requires local access on hosts equipped with Mellanox network hardware and can lead to a kernel crash or privilege escalation. The flaw only manifests when user-space applications invoke unsupported firmware commands via the device execution (DEVX) interface and those commands subsequently fail. Systems lacking Mellanox ConnectX hardware or configurations that do not grant unprivileged access to RDMA devices are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.