Database/Kernel, userspace & hypervisor
Linux vdpa: missing netlink attribute policy allows out-of-bounds read on vdpa config
Impact
vdpa_nl_policy omitted the max virtqueue pairs attribute, so the netlink parser can hand a handler an attribute shorter than it expects and the handler reads out of bounds - the same shape as CVE-2023-3773. vDPA is the hardware-assisted virtio datapath used with SmartNICs and DPUs, so this sits on the management path of exactly the devices that front GPU nodes. The vdpa netlink family is administrative, so the exposure is kernel memory disclosure or a crash from a host process holding net admin rights, not a tenant escape.
Who can reach it
Local, requires CAP_NET_ADMIN to send vdpa netlink management messages. Not reachable from a guest or an unprivileged container.
What to do
Patch the host kernel to a stable release that adds the missing nla_policy entry and reboot the node after draining. Hosts without vDPA devices or with the vdpa module unloaded are not exposed.
References
Related entries
- Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2023-53552 · Linux i915 GPU kernel driverHigh
- Linux kernel LIO iSCSI target: per-connection configfs output overflows the buffer with enough sessionsCVE-2023-53676 · Linux kernel iSCSI target (LIO lio_target_nacl_info_show configfs output)High
- Linux kernel arm64 SME: fixed 8-byte FFR clear corrupts memory past the SVE context structCVE-2023-53713 · Linux kernel arm64 SME signal/context save (FFR field clear)High
- Linux kernel (net/smc): Closing an SMC socket can leave the internal TCP kernel socket with its timers still armed andCVE-2023-53781 · Linux kernel (net/smc)High
- Linux kernel bpf: reused slab objects leave htab special fields stale, causing hard lockupCVE-2023-53790 · Linux kernel BPF memory allocator (non-preallocated htab map values)High
- Linux kernel (drivers/iommu/iommufd): The destroy ioctl takes a temporary reference on an iommufd object without theCVE-2023-53795 · Linux kernel (drivers/iommu/iommufd)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.