CVE-2023-53570
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-53570
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53570.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-53570
- Downstream
- Published
- 2025-10-04T15:17:11Z
- Modified
- 2025-10-16T18:41:33.924409Z
- Summary
- wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: fix integer overflow in nl80211parsembssid_elems()
nl80211parsembssidelems() uses a u8 variable numelems to count the number of MBSSID elements in the nested netlink attribute attrs, which can lead to an integer overflow if a user of the nl80211 interface specifies 256 or more elements in the corresponding attribute in userspace. The integer overflow can lead to a heap buffer overflow as num_elems determines the size of the trailing array in elems, and this array is thereafter written to for each element in attrs.
Note that this vulnerability only affects devices with the wiphy->mbssidmaxinterfaces member set for the wireless physical device struct in the device driver, and can only be triggered by a process with CAPNETADMIN capabilities.
Fix this by checking for a maximum of 255 elements in attrs.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceddc1e3cb8da8b414b37208b2fb6755fef8122504bFixede642eb67b8c10dcce758d549cc81564116e0fa49
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceddc1e3cb8da8b414b37208b2fb6755fef8122504bFixed7d09f9f255a5f78578deba5454923072bb53b16c
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceddc1e3cb8da8b414b37208b2fb6755fef8122504bFixed6311071a056272e1e761de8d0305e87cc566f734