{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-53495", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-10-01T11:39:39.403Z", "datePublished": "2025-10-01T11:45:46.877Z", "dateUpdated": "2026-08-05T09:14:27.541Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:14:27.541Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()\n\nrules is allocated in ethtool_get_rxnfc and the size is determined by\nrule_cnt from user space. So rule_cnt needs to be check before using\nrules to avoid OOB writing or NULL pointer dereference." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through the `SIOCETHTOOL` ioctl on a local socket (`dev_ioctl` → `dev_ethtool` → `mvpp2_ethtool_get_rxnfc`), requiring a local process on the system. No remote or adjacent-network input reaches this code path.\nAC:L - The attacker fully controls `info.rule_cnt` and can deterministically choose the undersized (or NULL) buffer; there is no race, no secret to guess, and no memory-layout dependency, and `queue_mode` defaults to the multi-queue mode that enables the path. The only precondition is a persistent, standard ntuple flow-steering configuration, after which the attack succeeds 100% of the time and can be repeated at will.\nPR:L - `ETHTOOL_GRXCLSRLALL` is explicitly listed in `__dev_ethtool()`'s \"Allow some commands to be done by anyone\" whitelist, so it bypasses the `ns_capable(net->user_ns, CAP_NET_ADMIN)` check — any unprivileged local user, including one confined to a sandbox or container, can invoke it. Only a basic local account is needed, not root or CAP_NET_ADMIN.\nUI:N - The attacker performs the entire attack with a single ioctl from their own process; no victim action is required at attack time. The pre-existing ntuple rule configuration is ambient system state, not an interaction the attacker must induce.\nS:U - The out-of-bounds write corrupts kernel slab memory within the same kernel security authority, and the resulting RTNL deadlock/panic affects the same OS instance. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a heap out-of-bounds write into adjacent `kmalloc-8`/`kmalloc-16` objects reachable by any unprivileged user, and such slab corruption — including of SLUB freelist pointers and neighbouring length/index fields — can be groomed via userspace heap spraying into a kernel memory disclosure primitive. Per kernel scoring guidance, memory corruption leverageable for info disclosure is scored High.\nI:H - `rules[loc++] = i` writes up to 16 bytes into an attacker-sized 4/8/12-byte allocation, a genuine out-of-bounds slab write that lets the attacker overwrite fields of adjacent heap objects. Out-of-bounds writes are scored High as they are the classic basis for control-flow hijacking and privilege escalation.\nA:H - With `rule_cnt = 0` the driver writes through a NULL `rule_buf`, causing an immediate kernel oops, and the OOB variant corrupts slab freelists leading to later crashes. Because `dev_ethtool()` holds `rtnl_lock()` across the call, the oops leaves RTNL permanently held — wedging all networking configuration system-wide with unkillable D-state tasks, or panicking outright on the `panic_on_oops` appliance/embedded systems typical of mvpp2 hardware." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c" ], "versions": [ { "version": "90b509b39ac9b09be88eb641c7a3abd8de06b698", "lessThan": "ba6673824efa3dc198b04a54e69dce480066d7d9", "status": "affected", "versionType": "git" }, { "version": "90b509b39ac9b09be88eb641c7a3abd8de06b698", "lessThan": "61054a8ddb176b155a8f2bacdfefb3727187f5d9", "status": "affected", "versionType": "git" }, { "version": "90b509b39ac9b09be88eb641c7a3abd8de06b698", "lessThan": "5bb09dddc724c5f7c4dc6dd3bfebd685eecd93e8", "status": "affected", "versionType": "git" }, { "version": "90b509b39ac9b09be88eb641c7a3abd8de06b698", "lessThan": "349638f7e5d3c7d328565587bb7b0454bbee02e2", "status": "affected", "versionType": "git" }, { "version": "90b509b39ac9b09be88eb641c7a3abd8de06b698", "lessThan": "625b70d31dd4df4b96b3ddcbe251debb33bd67f5", "status": "affected", "versionType": "git" }, { "version": "90b509b39ac9b09be88eb641c7a3abd8de06b698", "lessThan": "51fe0a470543f345e3c62b6798929de3ddcedc1d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c" ], "versions": [ { "version": "5.2", "status": "affected" }, { "version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.257", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.195", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.132", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.54", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.5.4", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.4.257" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.10.195" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.15.132" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.1.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.5.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.6" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ba6673824efa3dc198b04a54e69dce480066d7d9" }, { "url": "https://git.kernel.org/stable/c/61054a8ddb176b155a8f2bacdfefb3727187f5d9" }, { "url": "https://git.kernel.org/stable/c/5bb09dddc724c5f7c4dc6dd3bfebd685eecd93e8" }, { "url": "https://git.kernel.org/stable/c/349638f7e5d3c7d328565587bb7b0454bbee02e2" }, { "url": "https://git.kernel.org/stable/c/625b70d31dd4df4b96b3ddcbe251debb33bd67f5" }, { "url": "https://git.kernel.org/stable/c/51fe0a470543f345e3c62b6798929de3ddcedc1d" } ], "title": "net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()", "x_generator": { "engine": "bippy-1.2.0" } } } }