CVE-2023-53843

What it actually does

The flaw permits creation of Open vSwitch netdev ports with negative ifindex values because the kernel code did not validate the ifindex parameter supplied via netlink.

Why it matters to the business

Virtual networking setups using Open vSwitch on Linux may experience invalid interface indices, leading to operational instability, unexpected interface behavior, or crashes that disrupt connectivity in cloud, container, or virtualized environments.

How an attack unfolds

An attacker sends crafted netlink messages to first create an OVS datapath and then a vport, supplying a large unsigned value (4294901760) that represents a negative ifindex; the kernel previously accepted it silently, resulting in an interface with a negative index visible via ip link.

How to fix it

Update the Linux kernel to a version containing commit c965a58376146dcfdda186819462e8eb3aadef3a, which adds validation to reject negative ifindex values while continuing to accept 0.

How to confirm the fix worked

After the update, attempt the same netlink vport creation with a negative ifindex value; the operation must now return a Netlink error indicating 'Numerical result out of range' or 'integer out of range'.

Typical attack path

1. Create OVS datapath using netlink (ovs_datapath.yaml new)
2. Create vport with negative ifindex using netlink (ovs_vport.yaml new, ifindex=4294901760)
3. Observe resulting interface via ip link or trigger further network operations

How to detect it

Inspect netlink traces or system logs for OVS vport creation attempts containing large ifindex values that decode to negatives, or interfaces reported with negative indices via ip link output.

• ifindex":4294901760
• Numerical result out of range
• integer out of range
• bad-attr': '.ifindex'

What your security team should do

• Apply kernel updates containing commit c965a58376146dcfdda186819462e8eb3aadef3a across all affected systems
• Test Open vSwitch functionality in staging before broad deployment
• Review netlink activity and OVS port creation logs for anomalous ifindex values