CVE-2023-53342

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: marvell: prestera: fix handling IPv4 routes with nhid

Fix handling IPv4 routes referencing a nexthop via its id by replacing

calls to fib_info_nh() with fib_info_nhc().

Trying to add an IPv4 route referencing a nextop via nhid:

$ ip link set up swp5

$ ip a a 10.0.0.1/24 dev swp5

$ ip nexthop add dev swp5 id 20 via 10.0.0.2

$ ip route add 10.0.1.0/24 nhid 20

triggers warnings when trying to handle the route:

[ 528.805763] ------------[ cut here ]------------

[ 528.810437] WARNING: CPU: 3 PID: 53 at include/net/nexthop.h:468 __prestera_fi_is_direct+0x2c/0x68 [prestera]

[ 528.820434] Modules linked in: prestera_pci act_gact act_police sch_ingress cls_u32 cls_flower prestera arm64_delta_tn48m_dn_led(O) arm64_delta_tn48m_dn_cpld(O) [last unloaded: prestera_pci]

[ 528.837485] CPU: 3 PID: 53 Comm: kworker/u8:3 Tainted: G O 6.4.5 #1

[ 528.845178] Hardware name: delta,tn48m-dn (DT

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References