CVE-2023-53034: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
In the Linux kernel, the following vulnerability has been resolved:
ntbhwswitchtec: Fix shift-out-of-bounds in switchtecntbmwsettrans
There is a kernel API ntbmwcleartrans() would pass 0 to both addr and size. This would make xlatepos negative.
[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntbhwswitchtec.c:293:7 [ 23.734418] shift exponent -1 is negative
Ensuring xlatepos is a positive or zero before BIT.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure xlate_pos is checked so it is positive or zero before it is used in the BIT shift calculation (preventing shift exponent from becoming negative).
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53034?
The severity of CVE-2023-53034 is classified as medium due to the potential for shift-out-of-bounds errors in the Linux kernel.
How do I fix CVE-2023-53034?
To fix CVE-2023-53034, upgrade to the latest patched version of the Linux kernel that addresses this vulnerability.
What versions of the Linux kernel are affected by CVE-2023-53034?
CVE-2023-53034 affects various versions of the Linux kernel from 4.16 up to 6.14.2, specifically within certain version ranges.
What causes the CVE-2023-53034 vulnerability?
The CVE-2023-53034 vulnerability is caused by a kernel API function ntb_mw_clear_trans() improperly passing zero values, leading to negative shifts.
Is CVE-2023-53034 exploitable?
Yes, CVE-2023-53034 is exploitable, potentially allowing unauthorized access or unintended behavior in systems running affected kernel versions.