CVE-2023-54031

What it actually does

Missing nla_policy entry for the vdpa queue index attribute allows an unvalidated nlattr to reach handlers, resulting in an out-of-bounds read during netlink message parsing in the vdpa subsystem.

Why it matters to the business

Systems running affected kernels may experience kernel crashes or unintended information disclosure when vdpa netlink interfaces receive crafted messages, increasing operational risk for virtualization and storage workloads until patched.

How an attack unfolds

An attacker with local access crafts a netlink message containing an oversized or malformed queue index attribute, sends it to the vdpa netlink family, and triggers parsing that reads past allocated buffers, similar to prior netlink policy bypasses.

How to fix it

Upgrade the Linux kernel to a version containing commit 8ad9bc25cbdcec72e7ca43dd8281decb69ea9a70 or later; for affected package ecosystems apply the corresponding fixed releases such as mkcert 1.4.4-r14 where applicable.

How to confirm the fix worked

Confirm the presence of the queue index nla_policy entry in vdpa_nl_policy after applying the update and verify that netlink attribute length checks now cover the queue index attribute.

Typical attack path

1. Obtain local access on a system with vdpa enabled
2. Identify the vdpa netlink family and required message format
3. Construct a netlink message omitting or mis-sizing the queue index attribute
4. Send the message to trigger policy validation bypass and OOB read
5. Observe kernel panic or exfiltrate leaked memory contents

How to detect it

Review kernel audit logs and netlink message traces for malformed vdpa family requests; inspect for crashes referencing vdpa_nl_policy or queue index handling around the time of suspicious local activity.

What your security team should do

• Prioritize kernel updates on systems exposing vdpa netlink interfaces
• Monitor EPSS trend and any new exploit maturity indicators for this issue
• Restrict unprivileged access to netlink sockets until patches are deployed