CVE-2023-53524
published 2025-10-01CVE-2023-53524: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf An integer overflow…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.16%
5.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
An integer overflow occurs in the iwl_write_to_user_buf() function,
which is called by the iwl_dbgfs_monitor_data_read() function.
static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count,
void *buf, ssize_t *size,
ssize_t *bytes_copied)
{
int buf_size_left = count - *bytes_copied;
buf_size_left = buf_size_left - (buf_size_left % sizeof(u32));
if (*size > buf_size_left)
*size = buf_size_left;
If the user passes a SIZE_MAX value to the "ssize_t count" parameter,
the ssize_t count parameter is assigned to "int buf_size_left".
Then compare "*size" with "buf_size_left" . Here, "buf_size_left" is a
negative number, so "*size" is assigned "buf_size_left" and goes into
the third argument of the copy_to_user function, causing a heap overflow.
This is not a security vulnerability because iwl_dbgfs_monitor_data_read()
is a debugfs operation with 0400 privileges.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.37-1 (bookworm) | linux 6.1.37-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= f7805b33f9b13a87b1fcf9dfbc3dcbce281a1436 < 0ad8dd870aa187d0c21d032bb2c6433559075eec | 0ad8dd870aa187d0c21d032bb2c6433559075eec |
| linux | linux | >= f7805b33f9b13a87b1fcf9dfbc3dcbce281a1436 < 059e426d666a41e26b184c177c1ca3ee2d6fa1b6 | 059e426d666a41e26b184c177c1ca3ee2d6fa1b6 |
| linux | linux | >= f7805b33f9b13a87b1fcf9dfbc3dcbce281a1436 < 82f877ec9b041edc4c7c509c605cc3393d837bf0 | 82f877ec9b041edc4c7c509c605cc3393d837bf0 |
| linux | linux | >= f7805b33f9b13a87b1fcf9dfbc3dcbce281a1436 < eb1ef44efac797b384d361a76e33f77027c29a14 | eb1ef44efac797b384d361a76e33f77027c29a14 |
| linux | linux | >= f7805b33f9b13a87b1fcf9dfbc3dcbce281a1436 < de78456976026102babe66258c228691ca5677c0 | de78456976026102babe66258c228691ca5677c0 |
| linux | linux | >= f7805b33f9b13a87b1fcf9dfbc3dcbce281a1436 < 58d1b717879bfeabe09b35e41ad667c79933eb2e | 58d1b717879bfeabe09b35e41ad667c79933eb2e |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.37-1 | 6.1.37-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 5.0 < 5.4.244 | 5.4.244 |
| linux | linux_kernel | >= 5.11 < 5.15.113 | 5.15.113 |
| linux | linux_kernel | >= 5.16 < 6.1.30 | 6.1.30 |
| linux | linux_kernel | >= 5.5 < 5.10.181 | 5.10.181 |
| linux | linux_kernel | >= 6.2 < 6.3.4 | 6.3.4 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pvr4-g739-vh5v: In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
An integer ov
ghsa_unreviewed·2025-10-01
CVE-2023-53524 [HIGH] CWE-190 GHSA-pvr4-g739-vh5v: In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
An integer ov
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
An integer overflow occurs in the iwl_write_to_user_buf() function,
which is called by the iwl_dbgfs_monitor_data_read() function.
static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count,
void *buf, ssize_t *size,
ssize_t *bytes_copied)
{
int buf_size_left = count - *bytes_copied;
buf_size_left = buf_size_left - (buf_size_left % sizeof(u32));
if (*size > buf_size_left)
*size = buf_size_left;
If the user passes a SIZE_MAX value to the "ssize_t count" parameter,
the ssize_t count parameter is assigned to "int buf_size_left".
Then compare "*size" with "buf_size_left" . Here, "buf_size_left" is a
negative number, so "*size" is assigned "buf_
OSV
CVE-2023-53524: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf An integer over
osv·2025-10-01·CVSS 7.8
CVE-2023-53524 [HIGH] CVE-2023-53524: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf An integer over
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf An integer overflow occurs in the iwl_write_to_user_buf() function, which is called by the iwl_dbgfs_monitor_data_read() function. static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count, void *buf, ssize_t *size, ssize_t *bytes_copied) { int buf_size_left = count - *bytes_copied; buf_size_left = buf_size_left - (buf_size_left % sizeof(u32)); if (*size > buf_size_left) *size = buf_size_left; If the user passes a SIZE_MAX value to the "ssize_t count" parameter, the ssize_t count parameter is assigned to "int buf_size_left". Then compare "*size" with "buf_size_left" . Here, "buf_size_left" is a negative number, so "*size" is assigned "buf_size_
Red Hat
kernel: Linux kernel: Integer overflow in iwlwifi debugfs function
vendor_redhat·2025-10-01·CVSS 7.8
CVE-2023-53524 [HIGH] CWE-190 kernel: Linux kernel: Integer overflow in iwlwifi debugfs function
kernel: Linux kernel: Integer overflow in iwlwifi debugfs function
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
An integer overflow occurs in the iwl_write_to_user_buf() function,
which is called by the iwl_dbgfs_monitor_data_read() function.
static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count,
void *buf, ssize_t *size,
ssize_t *bytes_copied)
{
int buf_size_left = count - *bytes_copied;
buf_size_left = buf_size_left - (buf_size_left % sizeof(u32));
if (*size > buf_size_left)
*size = buf_size_left;
If the user passes a SIZE_MAX value to the "ssize_t count" parameter,
the ssize_t count parameter is assigned to "int buf_size_left".
Then compare "*size" with "buf_size_left" . Here, "bu
Debian
CVE-2023-53524: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwi...
vendor_debian·2023·CVSS 7.8
CVE-2023-53524 [HIGH] CVE-2023-53524: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwi...
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf An integer overflow occurs in the iwl_write_to_user_buf() function, which is called by the iwl_dbgfs_monitor_data_read() function. static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count, void *buf, ssize_t *size, ssize_t *bytes_copied) { int buf_size_left = count - *bytes_copied; buf_size_left = buf_size_left - (buf_size_left % sizeof(u32)); if (*size > buf_size_left) *size = buf_size_left; If the user passes a SIZE_MAX value to the "ssize_t count" parameter, the ssize_t count parameter is assigned to "int buf_size_left". Then compare "*size" with "buf_size_left" . Here, "buf_size_left" is a negative number, so "*size" is assigned "buf_size_
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/059e426d666a41e26b184c177c1ca3ee2d6fa1b6https://git.kernel.org/stable/c/0ad8dd870aa187d0c21d032bb2c6433559075eechttps://git.kernel.org/stable/c/58d1b717879bfeabe09b35e41ad667c79933eb2ehttps://git.kernel.org/stable/c/82f877ec9b041edc4c7c509c605cc3393d837bf0https://git.kernel.org/stable/c/de78456976026102babe66258c228691ca5677c0https://git.kernel.org/stable/c/eb1ef44efac797b384d361a76e33f77027c29a14
2025-10-01
Published