CVE-2023-53652

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops.

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.

Missing nla_policy for VDPA_ATTR_DEV_FEATURES allowed an unchecked nlattr to pass parsing and be used by handlers, causing an out-of-bounds read. A local actor with CAP_NET_ADMIN could trigger a crash during vDPA netlink operations, impacting availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.