CVE-2023-53667

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize

Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than

the calculated "min" value, but greater than zero, the logic sets

tx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in

cdc_ncm_fill_tx_frame() where all the data is handled.

For small values of dwNtbOutMaxSize the memory allocated during

alloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to

how size is aligned at alloc time:

size = SKB_DATA_ALIGN(size);

size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));

Thus we hit the same bug that we tried to squash with

commit 2be6d4d16a084 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero")

Low values of dwNtbOutMaxSize do not cause an issue presently because at

alloc_skb() time more memory (512b) is allocated than required for the

SKB headers alone (320b), leaving some space (512b - 320b = 19

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References