CVE-2023-53513

What it actually does

Improper validation of nbd_ioctl arguments permits excessively large values to reach nbd_set_size, causing signed integer overflow in i_size calculations and truncation to int in nbd_add_socket, resulting in kernel UBSAN faults during block writes.

Why it matters to the business

Local processes can trigger kernel crashes or storage misbehavior on systems exposing NBD devices, leading to service disruption for workloads relying on network block storage until kernels are updated.

How an attack unfolds

A local attacker invokes nbd_ioctl on an NBD device with crafted 64-bit arguments that overflow when used to set device size or are truncated when adding sockets, then performs write operations that surface the integer overflow in page writeback paths.

How to fix it

Upgrade Linux kernels to fixed versions including Debian 5.10.46-1 packages or mainline commit 52851d0c3354b397c11d31dfeb8b2a2fc85a0002 that add size and argument bounds checks before nbd_set_size and nbd_add_socket.

How to confirm the fix worked

Confirm kernel version matches or exceeds the listed fixed releases, recompile with UBSAN enabled and replay the reported ioctl sequences to verify absence of signed integer overflow warnings in fs/buffer.c.

Typical attack path

1. Obtain local unprivileged access on a system with NBD support
2. Open an NBD block device or control interface
3. Issue nbd_ioctl calls with large or boundary values for size or socket arguments
4. Trigger writeback operations to induce the overflow in __block_write_full_page

How to detect it

Search kernel logs and dmesg for UBSAN warnings mentioning fs/buffer.c:1709, signed integer overflow, nbd_ioctl, nbd_set_size, or blkdev_writepage originating from nbd userspace processes.

• UBSAN: Undefined behaviour in fs/buffer.c:1709:35
• signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long long int'
• nbd_ioctl
• nbd_set_size
• nbd_add_socket

What your security team should do

• Prioritize kernel package updates on all systems exposing NBD devices
• Limit unprivileged local access to NBD ioctls via LSM or seccomp filters where feasible
• Monitor for UBSAN reports referencing buffer.c and nbd_ioctl until patches are deployed