CVE-2023-53659

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the iavf driver related to out-of-bounds access during device removal when the number of channels is improperly handled. Specifically, if the number of channels is set to a value greater than the allocated transmit/receive rings, a kernel memory corruption issue can occur. This can lead to system instability or potentially allow for malicious code execution. The issue arises during the iavf remove function, triggered by setting a higher number of channels and a timeout during reset. The reproducer involves setting and resetting the number of virtual functions (VFs) and configuring network interfaces with combined channels.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.