Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2023-54300

wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should validate pkt_len before accessing the SKB. For example, the obtained SKB may have been badly constructed with pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr but after being processed in ath9k_htc_rx_msg() and passed to ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI command header which should be located inside its data payload. Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit memory can be referenced. Tested on Qualcomm Atheros Communications AR9271 802.11n . Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • fb9987d0f748c983bb795a86f47522313f701a08 to < 0bc12e41af4e3ae1f0efecc377f0514459df0707affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 28259ce4f1f1f9ab37fa817756c89098213d2fc0affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 90e3c10177573b8662ac9858abd9bf731d5d98e0affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 250efb4d3f5b32a115ea6bf25437ba44a1b3c04faffected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < ad5425e70789c29b93acafb5bb4629e4eb908296affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < d1c2ff2bd84c3692c9df267a2b991ce92bfca8efaffected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 8ed572e52714593b209e3aa352406aff84481179affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 75acec91aeaa07375cd5f418069e61b16d39bbadaffected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < f24292e827088bba8de7158501ac25a59b064953affected

Linux Linux

Default version status: affected

  • 2.6.35affected
  • 0 to < 2.6.35unaffected
  • 4.14.322 to ≤ 4.14.*unaffected
  • 4.19.291 to ≤ 4.19.*unaffected
  • 5.4.251 to ≤ 5.4.*unaffected
  • 5.10.188 to ≤ 5.10.*unaffected
  • 5.15.121 to ≤ 5.15.*unaffected
  • 6.1.39 to ≤ 6.1.*unaffected
  • 6.3.13 to ≤ 6.3.*unaffected
  • 6.4.4 to ≤ 6.4.*unaffected
  • 6.5 to ≤ *unaffected

References