CVE-2023-53513

A flaw has been found in the Linux kernel’s NBD drivers.The issue stems from incomplete validation of IOCTL arguments passed to the NBD driver. Specifically, oversized or unchecked arguments may lead to a signed integer overflow in __block_write_full_page() and misuse of argument values cast to int in nbd_add_socket().

This vulnerability is rated as Moderate severity rather than Important because exploitation requires local access with permissions to issue control operations against a network block device, restricting the attack surface from unauthenticated remote threats. In default Red Hat Enterprise Linux deployments, the network block device driver is not loaded automatically and is not required for typical system operations. An attacker must already possess local access on a system configured with active network block devices to trigger memory corruption or a kernel denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.