CVE-2023-53499 (GCVE-0-2023-53499)
Vulnerability from cvelistv5
Published
2025-10-01 11:45
Modified
2026-08-05 09:14
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix error unwinding of XDP initialization When initializing XDP in virtnet_open(), some rq xdp initialization may hit an error causing net device open failed. However, previous rqs have already initialized XDP and enabled NAPI, which is not the expected behavior. Need to roll back the previous rq initialization to avoid leaks in error unwinding of init code. Also extract helper functions of disable and enable queue pairs. Use newly introduced disable helper function in error unwinding and virtnet_close. Use enable helper function in virtnet_open.
References
Impacted products
Vendor Product Version
Linux Linux Version: 754b8a21a96d5f11712245aef907149606b323ae
Version: 754b8a21a96d5f11712245aef907149606b323ae
Version: 754b8a21a96d5f11712245aef907149606b323ae
Version: 754b8a21a96d5f11712245aef907149606b323ae
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a7690f2bd178eee80f33411ae32e543ae66379c",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            },
            {
              "lessThan": "73f53bc295727a3cdbd9d6bcdfaa239258970cf4",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            },
            {
              "lessThan": "037768b28e3752c07d63d1c72a651a6775b080bb",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            },
            {
              "lessThan": "5306623a9826aa7d63b32c6a3803c798a765474d",
              "status": "affected",
              "version": "754b8a21a96d5f11712245aef907149606b323ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix error unwinding of XDP initialization\n\nWhen initializing XDP in virtnet_open(), some rq xdp initialization\nmay hit an error causing net device open failed. However, previous\nrqs have already initialized XDP and enabled NAPI, which is not the\nexpected behavior. Need to roll back the previous rq initialization\nto avoid leaks in error unwinding of init code.\n\nAlso extract helper functions of disable and enable queue pairs.\nUse newly introduced disable helper function in error unwinding and\nvirtnet_close. Use enable helper function in virtnet_open."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is `virtnet_open()`, reached only through the local administrative interface-up path (`dev_change_flags` via RTM_NEWLINK/SIOCSIFFLAGS) or the PM resume path `virtnet_restore_up()`. No remote peer data or received packet can reach it, so this requires local system access.\nAC:H - The faulty unwind path executes only if `xdp_rxq_info_reg()` or `xdp_rxq_info_reg_mem_model()` returns an error, and in every affected version (4.16\u20136.4) the latter short-circuits to 0 for `MEM_TYPE_PAGE_SHARED` with a NULL allocator while the former only fails on `!dev` or `REG_STATE_UNUSED`, neither of which virtio_net can produce. These are internal driver-invariant conditions with no attacker-controlled input or allocation involved, i.e. entirely beyond the attacker\u0027s influence.\nPR:L - Bringing the interface up requires CAP_NET_ADMIN in the network namespace owning the virtio-net device, not global root, and that capability can be held by a container/VM-guest administrator who is unprivileged with respect to the host. Treating this as Low rather than High is the higher-severity and defensible reading.\nUI:N - The attacker performs the interface-up (or triggers a suspend/resume) themselves; no action by any other user is needed to reach or complete the faulty error path.\nS:U - The leaked NAPI/xdp_rxq state and the orphaned refill work are all within the guest kernel\u0027s own security authority. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The un-cancelled `vi-\u003erefill` delayed work and still-registered `xdp_rxq_info` reference `virtnet_info`/`receive_queue` memory that `free_netdev()` releases on unbind or module unload, giving a use-after-free on freed slab data. Per kernel scoring guidance a UAF is treated as High confidentiality impact because the reclaimed object contents can be groomed and read back.\nI:H - The same stale refill work writes into the freed receive-queue/page-frag structures (`try_fill_recv`, `virtnet_napi_enable`), which is a write into reclaimed memory the attacker can heap-spray. A use-after-free write primitive of this form is scored as High integrity impact.\nA:H - A subsequent `virtnet_open()` on the leaked state hits `BUG_ON(!test_bit(NAPI_STATE_SCHED, ...))` in `napi_enable()` and `WARN(1, \"Missing unregister, handled but fix driver\")` in `xdp_rxq_info_reg()`, either of which panics the kernel (the WARN under panic_on_warn), and the orphaned refill work independently causes a UAF oops. Any such crash is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:28.613Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a7690f2bd178eee80f33411ae32e543ae66379c"
        },
        {
          "url": "https://git.kernel.org/stable/c/73f53bc295727a3cdbd9d6bcdfaa239258970cf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/037768b28e3752c07d63d1c72a651a6775b080bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/5306623a9826aa7d63b32c6a3803c798a765474d"
        }
      ],
      "title": "virtio_net: Fix error unwinding of XDP initialization",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53499",
    "datePublished": "2025-10-01T11:45:50.367Z",
    "dateReserved": "2025-10-01T11:39:39.404Z",
    "dateUpdated": "2026-08-05T09:14:28.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.