CVE-2023-53516

In the Linux kernel, the following vulnerability has been resolved:

macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF

The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff") added one additional attribute named IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff.

However, it forgot to describe the nla_policy at macvlan_policy (drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer can be faked as empty (0 bytes) by a malicious user, which could leads to OOB in heap just like CVE-2023-3773.

To fix it, this commit just completes the nla_policy description for IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the potential OOB read.

The patch adds the missing nla_policy entry for IFLA_MACVLAN_BC_CUTOFF, enforcing a 4-byte NLA_S32 and preventing a heap out-of-bounds read. Impact is mainly information disclosure and possibly a local DoS during malformed netlink processing; there is no clear integrity impact. For the CVSS the PR:H because crafting the malicious netlink attribute typically requires CAP_NET_ADMIN (creating/modifying macvlan links). In containerized setups where that capability is delegated, effective privileges may be lower.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.