CVE-2023-53843
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openvswitch | openvswitch | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's openvswitch component involves improper validation of the ifindex (interface index) value. Specifically, openvswitch did not validate ifindex values, allowing the creation of network device ports with negative ifindex values. This issue was exposed due to recent changes in the kernel's net-next code. The vulnerability could be reproduced by creating netdev ports with negative ifindex values, which is invalid. The fix involves rejecting negative ifindex values and validating inputs to prevent such invalid values.
How can this vulnerability impact me? :
The vulnerability allows creation of network device ports with invalid negative ifindex values, which can lead to unexpected behavior or instability in the network stack or applications relying on valid interface indices. This could potentially be exploited to cause denial of service or disrupt network operations by injecting malformed network device configurations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for network devices (netdev ports) with negative ifindex values. You can use the command 'ip link show' to list network interfaces and look for entries with negative ifindex numbers, such as '-65536: some-port0'. Additionally, reproducing the issue with the provided YNL commands can help identify the problem.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves validating the ifindex input values to prevent creation of netdev ports with negative ifindex. The fix includes rejecting negative ifindex values, which causes commands attempting to create such ports to return errors like 'Netlink error: Numerical result out of range'. Ensuring your system has this validation or applying the patch that rejects negative ifindex values is recommended.