CVE-2023-53543

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The vdpa nl policy structure, used for validating netlink attributes (nlattr) during message parsing, lacked a necessary check for the maximum virtual queue pair (VQP) attribute. This missing check could lead to illegal nlattr values after parsing, potentially resulting in an out-of-bounds (OOB) read, similar to CVE-2023-3773. The issue has been addressed by adding the missing nla policy for the vdpa max vqp attribute. The vdpa nl policy structure ensures a valid pointer in info->attrs before entering handlers in vdpa nl ops.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.