cbcvebase.
CVE-2023-52531
published 2024-03-02

CVE-2023-52531: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is kzalloc()'ed…

PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.24%
14.8th percentile
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine. At the end of this structure, there is the 'channels' flex array. Each element is of type 'struct ieee80211_channel'. So only 1 element is allocated in this array. When doing: mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels; We point at the first element of the 'channels' flex array. So this is fine. However, when doing: mvm->nvm_data->bands[0].bitrates = (void *)((u8 *)mvm->nvm_data->channels + 1); because of the "(u8 *)" cast, we add only 1 to the address of the beginning of the flex array. It is likely that we want point at the 'struct ieee80211_rate' allocated just after. Remove the spurious casting so that the pointer arithmetic works as expected.

Affected

16 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.64-1 (bookworm)linux 6.1.64-1 (bookworm)
linuxlinux
linuxlinux>= 8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c < 7c8faa31080342aec4903c9acb20caf82fcca1ef7c8faa31080342aec4903c9acb20caf82fcca1ef
linuxlinux>= 8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c < 6b3223449c959a8be94a1f042288059e40fcccb06b3223449c959a8be94a1f042288059e40fcccb0
linuxlinux>= 8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c < f06cdd8d4ba5252986f51f80cc30263636397128f06cdd8d4ba5252986f51f80cc30263636397128
linuxlinux>= 8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c < 8ba438ef3cacc4808a63ed0ce24d4f0942cfe55d8ba438ef3cacc4808a63ed0ce24d4f0942cfe55d
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.1.64-16.1.64-1
linuxlinux_kernel>= 0 < 6.5.8-16.5.8-1
linuxlinux_kernel>= 0 < 6.5.8-16.5.8-1
linuxlinux_kernel>= 0 < 5.4.0-200.2205.4.0-200.220
linuxlinux_kernel>= 0 < 4.4.0-261.2954.4.0-261.295
linuxlinux_kernel>= 0 < 4.15.0-231.2434.15.0-231.243
linuxlinux_kernel>= 3.9 < 5.15.1355.15.135
linuxlinux_kernel>= 5.16 < 6.1.576.1.57
linuxlinux_kernel>= 6.2 < 6.5.76.5.7

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.