CyberSecBulletin
CVE-2023-53395NVD status: Modified

Linux: Improper Validation of Array Index

Published Updated By the CyberSecBulletin desk

CVE-2023-53395 is a high-severity improper validation of array index vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 2f2a5905303ae230b5159fcd8cdcd5b3e7ad5e2d, 23c67fa615c52712bfa02a6dfadbd4656c87c066, 3bf4463e40a17a23f2f261dfd7fe23129bdd04a4 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 2f2a5905303ae230b5159fcd8cdcd5b3e7ad5e2d or 23c67fa615c52712bfa02a6dfadbd4656c87c066 or 3bf4463e40a17a23f2f261dfd7fe23129bdd04a4 or 625c12dc04a607b79f180ef3ee5a12bf2e3324c0, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.14.326 or 4.19.295 or 5.4.257 or 5.10.197, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 2f2a5905303ae230b5159fcd8cdcd5b3e7ad5e2d; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 23c67fa615c52712bfa02a6dfadbd4656c87c066; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 3bf4463e40a17a23f2f261dfd7fe23129bdd04a4; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 625c12dc04a607b79f180ef3ee5a12bf2e3324c0; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 430787056dd3c591eb553d5c3b2717efcf307d4e; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, e1f686930ee4b059c7baa3c3904b2401829f2589; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, b102113469487b460e9e77fe9e00d49c50fe8c86; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 3a21ffdbc825e0919db9da0e27ee5ff2cc8a863e; and 1 more ranges2f2a5905303ae230b5159fcd8cdcd5b3e7ad5e2d, 23c67fa615c52712bfa02a6dfadbd4656c87c066, 3bf4463e40a17a23f2f261dfd7fe23129bdd04a4, 625c12dc04a607b79f180ef3ee5a12bf2e3324c0, 430787056dd3c591eb553d5c3b2717efcf307d4e, e1f686930ee4b059c7baa3c3904b2401829f2589
LinuxLinux Kernelbefore 4.14.326; 4.15 up to, but not including, 4.19.295; 4.20 up to, but not including, 5.4.257; 5.5 up to, but not including, 5.10.197; 5.11 up to, but not including, 5.15.133; 5.16 up to, but not including, 6.1.55; 6.2 up to, but not including, 6.5.54.14.326, 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighNVD
CVSS 3.17.8HighCISA (ADP)

Official description

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer ACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5 According to the ACPI specification 19.6.134, no argument is required to be passed for ASL Timer instruction. For taking care of no argument, AML_NO_OPERAND_RESOLVE flag is added to ASL Timer instruction opcode. When ASL timer instruction interpreted by ACPI interpreter, getting error. After adding AML_NO_OPERAND_RESOLVE flag to ASL Timer instruction opcode, issue is not observed. ============================================================= UBSAN: array-index-out-of-bounds in acpica/dswexec.c:401:12 index -1 is out of range for type 'union acpi_operand_object *[9]' CPU: 37 PID: 1678 Comm: cat Not tainted 6.0.0-dev-th500-6.0.y-1+bcf8c46459e407-generic-64k HW name: NVIDIA BIOS v1.1.1-d7acbfc-dirty 12/19/2022 Call trace: dump_backtrace+0xe0/0x130 show_stack+0x20/0x60 dump_stack_lvl+0x68/0x84 dump_stack+0x18/0x34 ubsan_epilogue+0x10/0x50 __ubsan_handle_out_of_bounds+0x80/0x90 acpi_ds_exec_end_op+0x1bc/0x6d8 acpi_ps_parse_loop+0x57c/0x618 acpi_ps_parse_aml+0x1e0/0x4b4 acpi_ps_execute_method+0x24c/0x2b8 acpi_ns_evaluate+0x3a8/0x4bc acpi_evaluate_object+0x15c/0x37c acpi_evaluate_integer+0x54/0x15c show_power+0x8c/0x12c [acpi_power_meter]

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

How developers prevent this class of flaw

  • Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, Ada allows the programmer to constrain the values of a variable and languages such as Java and Ruby will allow the programmer to handle exceptions when an out-of-bounds index is accessed.
  • Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment. For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND.

More Improper Validation of Array Index vulnerabilities (CWE-129)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Validation of Array Index vulnerabilities

Spotted an error? Tell us.