CVE-2023-53513

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nbd: fix incomplete validation of ioctl arg

We tested and found an alarm caused by nbd_ioctl arg without verification.

The UBSAN warning calltrace like below:

UBSAN: Undefined behaviour in fs/buffer.c:1709:35

signed integer overflow:

-9223372036854775808 - 1 cannot be represented in type 'long long int'

CPU: 3 PID: 2523 Comm: syz-executor.0 Not tainted 4.19.90 #1

Hardware name: linux,dummy-virt (DT)

Call trace:

dump_backtrace+0x0/0x3f0 arch/arm64/kernel/time.c:78

show_stack+0x28/0x38 arch/arm64/kernel/traps.c:158

__dump_stack lib/dump_stack.c:77 [inline]

dump_stack+0x170/0x1dc lib/dump_stack.c:118

ubsan_epilogue+0x18/0xb4 lib/ubsan.c:161

handle_overflow+0x188/0x1dc lib/ubsan.c:192

__ubsan_handle_sub_overflow+0x34/0x44 lib/ubsan.c:206

__block_write_full_page+0x94c/0xa20 fs/buffer.c:1709

block_write_full_page+0x1f0/0x280 fs/buffer.c:2934

blkdev_writepage+0x34/0x40 fs/block_dev.c:607

__writepage+0x68/0xe8 mm

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References