CVE-2023-53369

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: dcb: choose correct policy to parse DCB_ATTR_BCN

The dcbnl_bcn_setcfg uses erroneous policy to parse tb[DCB_ATTR_BCN],

which is introduced in commit 859ee3c43812 ("DCB: Add support for DCB

BCN"). Please see the comment in below code

static int dcbnl_bcn_setcfg(...)

{

...

ret = nla_parse_nested_deprecated(..., dcbnl_pfc_up_nest, .. )

// !!! dcbnl_pfc_up_nest for attributes

// DCB_PFC_UP_ATTR_0 to DCB_PFC_UP_ATTR_ALL in enum dcbnl_pfc_up_attrs

...

for (i = DCB_BCN_ATTR_RP_0; i <= DCB_BCN_ATTR_RP_7; i++) {

// !!! DCB_BCN_ATTR_RP_0 to DCB_BCN_ATTR_RP_7 in enum dcbnl_bcn_attrs

...

value_byte = nla_get_u8(data[i]);

...

}

...

for (i = DCB_BCN_ATTR_BCNA_0; i <= DCB_BCN_ATTR_RI; i++) {

// !!! DCB_BCN_ATTR_BCNA_0 to DCB_BCN_ATTR_RI in enum dcbnl_bcn_attrs

...

value_int = nla_get_u32(data[i]);

...

}

...

}

That is, the nla_parse_nested_deprecated uses dcbnl_pfc_up_nest

attrib

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References