Message-ID: <2025091854-CVE-2023-53369-394e@gregkh>
Date: Thu, 18 Sep 2025 15:34:14 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53369: net: dcb: choose correct policy to parse DCB_ATTR_BCN

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: dcb: choose correct policy to parse DCB_ATTR_BCN

The dcbnl_bcn_setcfg uses erroneous policy to parse tb[DCB_ATTR_BCN],
which is introduced in commit 859ee3c43812 ("DCB: Add support for DCB
BCN"). Please see the comment in below code

static int dcbnl_bcn_setcfg(...)
{
  ...
  ret = nla_parse_nested_deprecated(..., dcbnl_pfc_up_nest, .. )
  // !!! dcbnl_pfc_up_nest for attributes
  //  DCB_PFC_UP_ATTR_0 to DCB_PFC_UP_ATTR_ALL in enum dcbnl_pfc_up_attrs
  ...
  for (i = DCB_BCN_ATTR_RP_0; i <= DCB_BCN_ATTR_RP_7; i++) {
  // !!! DCB_BCN_ATTR_RP_0 to DCB_BCN_ATTR_RP_7 in enum dcbnl_bcn_attrs
    ...
    value_byte = nla_get_u8(data[i]);
    ...
  }
  ...
  for (i = DCB_BCN_ATTR_BCNA_0; i <= DCB_BCN_ATTR_RI; i++) {
  // !!! DCB_BCN_ATTR_BCNA_0 to DCB_BCN_ATTR_RI in enum dcbnl_bcn_attrs
  ...
    value_int = nla_get_u32(data[i]);
  ...
  }
  ...
}

That is, the nla_parse_nested_deprecated uses dcbnl_pfc_up_nest
attributes to parse nlattr defined in dcbnl_pfc_up_attrs. But the
following access code fetch each nlattr as dcbnl_bcn_attrs attributes.
By looking up the associated nla_policy for dcbnl_bcn_attrs. We can find
the beginning part of these two policies are "same".

static const struct nla_policy dcbnl_pfc_up_nest[...] = {
        [DCB_PFC_UP_ATTR_0]   = {.type = NLA_U8},
        [DCB_PFC_UP_ATTR_1]   = {.type = NLA_U8},
        [DCB_PFC_UP_ATTR_2]   = {.type = NLA_U8},
        [DCB_PFC_UP_ATTR_3]   = {.type = NLA_U8},
        [DCB_PFC_UP_ATTR_4]   = {.type = NLA_U8},
        [DCB_PFC_UP_ATTR_5]   = {.type = NLA_U8},
        [DCB_PFC_UP_ATTR_6]   = {.type = NLA_U8},
        [DCB_PFC_UP_ATTR_7]   = {.type = NLA_U8},
        [DCB_PFC_UP_ATTR_ALL] = {.type = NLA_FLAG},
};

static const struct nla_policy dcbnl_bcn_nest[...] = {
        [DCB_BCN_ATTR_RP_0]         = {.type = NLA_U8},
        [DCB_BCN_ATTR_RP_1]         = {.type = NLA_U8},
        [DCB_BCN_ATTR_RP_2]         = {.type = NLA_U8},
        [DCB_BCN_ATTR_RP_3]         = {.type = NLA_U8},
        [DCB_BCN_ATTR_RP_4]         = {.type = NLA_U8},
        [DCB_BCN_ATTR_RP_5]         = {.type = NLA_U8},
        [DCB_BCN_ATTR_RP_6]         = {.type = NLA_U8},
        [DCB_BCN_ATTR_RP_7]         = {.type = NLA_U8},
        [DCB_BCN_ATTR_RP_ALL]       = {.type = NLA_FLAG},
        // from here is somewhat different
        [DCB_BCN_ATTR_BCNA_0]       = {.type = NLA_U32},
        ...
        [DCB_BCN_ATTR_ALL]          = {.type = NLA_FLAG},
};

Therefore, the current code is buggy and this
nla_parse_nested_deprecated could overflow the dcbnl_pfc_up_nest and use
the adjacent nla_policy to parse attributes from DCB_BCN_ATTR_BCNA_0.

Hence use the correct policy dcbnl_bcn_nest to parse the nested
tb[DCB_ATTR_BCN] TLV.

The Linux kernel CVE team has assigned CVE-2023-53369 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.29 with commit 859ee3c43812051e21816c6d6d4cc04fb7ce9b2e and fixed in 5.4.253 with commit 5b3dbedb8d4a0f9f7ce904d76b885438af2a21f9
	Issue introduced in 2.6.29 with commit 859ee3c43812051e21816c6d6d4cc04fb7ce9b2e and fixed in 5.10.190 with commit 8e309f43d0ca4051d20736c06a6f84bbddd881da
	Issue introduced in 2.6.29 with commit 859ee3c43812051e21816c6d6d4cc04fb7ce9b2e and fixed in 5.15.126 with commit a0da2684db18dead3bcee12fb185e596e3d63c2b
	Issue introduced in 2.6.29 with commit 859ee3c43812051e21816c6d6d4cc04fb7ce9b2e and fixed in 6.1.45 with commit ecff20e193207b44fdbfe64d7de89890f0a7fe6c
	Issue introduced in 2.6.29 with commit 859ee3c43812051e21816c6d6d4cc04fb7ce9b2e and fixed in 6.4.10 with commit 199fde04bd875d28b3a5ca525eaaa004eec6e947
	Issue introduced in 2.6.29 with commit 859ee3c43812051e21816c6d6d4cc04fb7ce9b2e and fixed in 6.5 with commit 31d49ba033095f6e8158c60f69714a500922e0c3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53369
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/dcb/dcbnl.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5b3dbedb8d4a0f9f7ce904d76b885438af2a21f9
	https://git.kernel.org/stable/c/8e309f43d0ca4051d20736c06a6f84bbddd881da
	https://git.kernel.org/stable/c/a0da2684db18dead3bcee12fb185e596e3d63c2b
	https://git.kernel.org/stable/c/ecff20e193207b44fdbfe64d7de89890f0a7fe6c
	https://git.kernel.org/stable/c/199fde04bd875d28b3a5ca525eaaa004eec6e947
	https://git.kernel.org/stable/c/31d49ba033095f6e8158c60f69714a500922e0c3

Powered by blists - more mailing lists