Out-of-Bounds Write Vulnerability in Linux Kernel Ethernet Driver

CVE-2023-53495

What is CVE-2023-53495?

A vulnerability exists in the Linux kernel's Ethernet driver where an out-of-bounds write could potentially occur in the mvpp2_ethtool_get_rxnfc() function. This issue stems from the way the 'rules' array is allocated based on user-supplied 'rule_cnt', which needs proper validation before usage to prevent both out-of-bounds writes and NULL pointer dereferences. If left unaddressed, this could lead to unexpected behavior or crashes in the affected systems, making it essential for users to apply the latest patches and updates.

References