CVE-2023-53652

What it actually does

Missing nla_policy entry for the vdpa features attribute in vdpa_nl_policy allows parsing of incoming netlink messages to produce an invalid nlattr pointer, enabling out-of-bounds read in vdpa_nl_ops handlers.

Why it matters to the business

Local attackers on affected Linux systems can read kernel memory beyond intended bounds, potentially leading to information disclosure or escalation of privileges on hosts using vdpa devices; widespread kernel deployments increase exposure across servers and containers.

How an attack unfolds

An attacker crafts a malicious netlink message lacking or malformed features attribute, bypasses length validation due to the incomplete policy, and triggers an OOB read in the vdpa handler similar to the technique in CVE-2023-3773; listed related privilege-escalation CVEs demonstrate ongoing kernel netlink attack patterns on container-optimized environments.

How to fix it

Update the Linux kernel to the commit 44b508cc96889e61799cc0fc6c00766a54f3ab5a or later stable releases that include the added nla_policy for the vdpa features attribute.

How to confirm the fix worked

Verify the presence of the nla_policy entry for vdpa features in vdpa_nl_policy after applying the fix; recompile and boot-test vdpa netlink message handling to confirm no OOB access occurs on malformed inputs.

Typical attack path

1. Identify a system running an unpatched kernel with vdpa support enabled.
2. Send a crafted netlink message via NETLINK_GENERIC to the vdpa family without a properly sized features attribute.
3. Trigger the nlmsg parsing path that relies on the incomplete vdpa_nl_policy.
4. Read kernel memory past the intended nlattr bounds to leak data or prepare for further exploitation.

How to detect it

Review kernel audit logs and netlink message traces for vdpa family messages with unexpected or missing attributes; correlate with process activity invoking netlink sockets around vdpa device initialization.

What your security team should do

• Apply the kernel patch containing commit 44b508cc96889e61799cc0fc6c00766a54f3ab5a immediately on all systems exposing vdpa interfaces.
• Prioritize updates for container hosts and environments matching the Container-Optimized OS patterns seen in related kernel CVEs.
• Monitor for new kernel releases and schedule regression testing of netlink vdpa paths.