In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hifusb: clean up skbs if ath9khifusbrx_stream() fails
Syzkaller detected a memory leak of skbs in ath9khifusbrxstream(). While processing skbs in ath9khifusbrxstream(), the already allocated skbs in skbpool are not freed if ath9khifusbrxstream() fails. If we have an incorrect pktlen or pkttag, the input skb is considered invalid and dropped. All the associated packets already in skbpool should be dropped and freed. Added a comment describing this issue.
The patch also makes remainskb NULL after being processed so that it cannot be referenced after potential free. The initialization of hifdev fields which are associated with remainskb (rxremainlen, rxtransferlen and rxpadlen) is moved after a new remainskb is allocated.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53199.json",
"cna_assigner": "Linux"
}[
{
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2413.0,
"function_hash": "216500981299337486501995119218065805046"
},
"id": "CVE-2023-53199-0620f444",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9acdec72787af1bc8ed92711b52118c8e3e638a2",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c",
"function": "ath9k_hif_usb_rx_stream"
}
},
{
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2413.0,
"function_hash": "216500981299337486501995119218065805046"
},
"id": "CVE-2023-53199-0f6bb242",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c766e37fccd5a5c5059be7efcd9618bf8a2c17c3",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c",
"function": "ath9k_hif_usb_rx_stream"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"5455752170813321545408535211124337246",
"225674242930134553640937099335933263907",
"307305875101941146045144167432453262891",
"186861900966454046983306299129705359715",
"36838939484097493668703015453741648798",
"307777164169940514981648498641048357549",
"88440626311447334904801279777636423483",
"236805071918882923718013761746608924690",
"237083481102420187976108106489805695668",
"304086709907512737928277504535885893448",
"308818338827502333582722761400230153031",
"189777857103932016589859667805187267486",
"11678645314796830121860039367616351726",
"89193860538943321392285885013240521522",
"91096608267985731790498273812193229431",
"26305735412698276699521032109435294040",
"95993125280897136601552422530167304367",
"164110937200694638450800782223286989696",
"16127891518108793295603296767063464211",
"315901859757101403273597886331562269752",
"231406466824361183150462092579442007923",
"338647972012040170870384485242938697844",
"174602275687692149902175874130999907020",
"76222849795276791079198889116606489148",
"143872109281492524104618201388942223607",
"290998123202248475849764547453070213615",
"269471914259567044716363203524461855705",
"313541592876228578104218890929768789440",
"283184454414911039917831315509541652669",
"68356392353622129976776700075451544212",
"1468411265760035873724644932274758480",
"239000323737631796328476385851283960774",
"70378070346519502317151724230760989863"
]
},
"id": "CVE-2023-53199-14da9f06",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9acdec72787af1bc8ed92711b52118c8e3e638a2",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
}
},
{
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2413.0,
"function_hash": "216500981299337486501995119218065805046"
},
"id": "CVE-2023-53199-2e154dfe",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fc6401fafde11712a83089fa2cc874cfd10e2cd",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c",
"function": "ath9k_hif_usb_rx_stream"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"5455752170813321545408535211124337246",
"225674242930134553640937099335933263907",
"307305875101941146045144167432453262891",
"186861900966454046983306299129705359715",
"36838939484097493668703015453741648798",
"307777164169940514981648498641048357549",
"88440626311447334904801279777636423483",
"236805071918882923718013761746608924690",
"237083481102420187976108106489805695668",
"304086709907512737928277504535885893448",
"308818338827502333582722761400230153031",
"189777857103932016589859667805187267486",
"11678645314796830121860039367616351726",
"89193860538943321392285885013240521522",
"91096608267985731790498273812193229431",
"26305735412698276699521032109435294040",
"95993125280897136601552422530167304367",
"164110937200694638450800782223286989696",
"16127891518108793295603296767063464211",
"315901859757101403273597886331562269752",
"231406466824361183150462092579442007923",
"338647972012040170870384485242938697844",
"174602275687692149902175874130999907020",
"76222849795276791079198889116606489148",
"143872109281492524104618201388942223607",
"290998123202248475849764547453070213615",
"269471914259567044716363203524461855705",
"313541592876228578104218890929768789440",
"283184454414911039917831315509541652669",
"68356392353622129976776700075451544212",
"1468411265760035873724644932274758480",
"239000323737631796328476385851283960774",
"70378070346519502317151724230760989863"
]
},
"id": "CVE-2023-53199-41d017cd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fc6401fafde11712a83089fa2cc874cfd10e2cd",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
}
},
{
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2413.0,
"function_hash": "216500981299337486501995119218065805046"
},
"id": "CVE-2023-53199-5160584b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61490d2710277e8a55009b7682456ae22f8087cf",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c",
"function": "ath9k_hif_usb_rx_stream"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"5455752170813321545408535211124337246",
"225674242930134553640937099335933263907",
"307305875101941146045144167432453262891",
"186861900966454046983306299129705359715",
"36838939484097493668703015453741648798",
"307777164169940514981648498641048357549",
"88440626311447334904801279777636423483",
"236805071918882923718013761746608924690",
"237083481102420187976108106489805695668",
"304086709907512737928277504535885893448",
"308818338827502333582722761400230153031",
"189777857103932016589859667805187267486",
"11678645314796830121860039367616351726",
"89193860538943321392285885013240521522",
"91096608267985731790498273812193229431",
"26305735412698276699521032109435294040",
"95993125280897136601552422530167304367",
"164110937200694638450800782223286989696",
"16127891518108793295603296767063464211",
"315901859757101403273597886331562269752",
"231406466824361183150462092579442007923",
"338647972012040170870384485242938697844",
"174602275687692149902175874130999907020",
"76222849795276791079198889116606489148",
"143872109281492524104618201388942223607",
"290998123202248475849764547453070213615",
"269471914259567044716363203524461855705",
"313541592876228578104218890929768789440",
"283184454414911039917831315509541652669",
"68356392353622129976776700075451544212",
"1468411265760035873724644932274758480",
"239000323737631796328476385851283960774",
"70378070346519502317151724230760989863"
]
},
"id": "CVE-2023-53199-56636293",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c766e37fccd5a5c5059be7efcd9618bf8a2c17c3",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"5455752170813321545408535211124337246",
"225674242930134553640937099335933263907",
"307305875101941146045144167432453262891",
"186861900966454046983306299129705359715",
"36838939484097493668703015453741648798",
"307777164169940514981648498641048357549",
"88440626311447334904801279777636423483",
"236805071918882923718013761746608924690",
"237083481102420187976108106489805695668",
"304086709907512737928277504535885893448",
"308818338827502333582722761400230153031",
"189777857103932016589859667805187267486",
"11678645314796830121860039367616351726",
"89193860538943321392285885013240521522",
"91096608267985731790498273812193229431",
"26305735412698276699521032109435294040",
"95993125280897136601552422530167304367",
"164110937200694638450800782223286989696",
"16127891518108793295603296767063464211",
"315901859757101403273597886331562269752",
"231406466824361183150462092579442007923",
"338647972012040170870384485242938697844",
"174602275687692149902175874130999907020",
"76222849795276791079198889116606489148",
"143872109281492524104618201388942223607",
"290998123202248475849764547453070213615",
"269471914259567044716363203524461855705",
"313541592876228578104218890929768789440",
"283184454414911039917831315509541652669",
"68356392353622129976776700075451544212",
"1468411265760035873724644932274758480",
"239000323737631796328476385851283960774",
"70378070346519502317151724230760989863"
]
},
"id": "CVE-2023-53199-7204f3f0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0af54343a76263a12dbae7fafb64eb47c4a6ad38",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
}
},
{
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2413.0,
"function_hash": "216500981299337486501995119218065805046"
},
"id": "CVE-2023-53199-94d4fbc2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0af54343a76263a12dbae7fafb64eb47c4a6ad38",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c",
"function": "ath9k_hif_usb_rx_stream"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"5455752170813321545408535211124337246",
"225674242930134553640937099335933263907",
"307305875101941146045144167432453262891",
"186861900966454046983306299129705359715",
"36838939484097493668703015453741648798",
"307777164169940514981648498641048357549",
"88440626311447334904801279777636423483",
"236805071918882923718013761746608924690",
"237083481102420187976108106489805695668",
"304086709907512737928277504535885893448",
"308818338827502333582722761400230153031",
"189777857103932016589859667805187267486",
"11678645314796830121860039367616351726",
"89193860538943321392285885013240521522",
"91096608267985731790498273812193229431",
"26305735412698276699521032109435294040",
"95993125280897136601552422530167304367",
"164110937200694638450800782223286989696",
"16127891518108793295603296767063464211",
"315901859757101403273597886331562269752",
"231406466824361183150462092579442007923",
"338647972012040170870384485242938697844",
"174602275687692149902175874130999907020",
"76222849795276791079198889116606489148",
"143872109281492524104618201388942223607",
"290998123202248475849764547453070213615",
"269471914259567044716363203524461855705",
"313541592876228578104218890929768789440",
"283184454414911039917831315509541652669",
"68356392353622129976776700075451544212",
"1468411265760035873724644932274758480",
"239000323737631796328476385851283960774",
"70378070346519502317151724230760989863"
]
},
"id": "CVE-2023-53199-956d989e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd8316767099920a5d41feed1afab0c482a43e9f",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
}
},
{
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2413.0,
"function_hash": "216500981299337486501995119218065805046"
},
"id": "CVE-2023-53199-aafe1f8c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd8316767099920a5d41feed1afab0c482a43e9f",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c",
"function": "ath9k_hif_usb_rx_stream"
}
},
{
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2413.0,
"function_hash": "216500981299337486501995119218065805046"
},
"id": "CVE-2023-53199-b438030a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f26dd69f61eff2eedf5df2d199bdd23108309947",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c",
"function": "ath9k_hif_usb_rx_stream"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"5455752170813321545408535211124337246",
"225674242930134553640937099335933263907",
"307305875101941146045144167432453262891",
"186861900966454046983306299129705359715",
"36838939484097493668703015453741648798",
"307777164169940514981648498641048357549",
"88440626311447334904801279777636423483",
"236805071918882923718013761746608924690",
"237083481102420187976108106489805695668",
"304086709907512737928277504535885893448",
"308818338827502333582722761400230153031",
"189777857103932016589859667805187267486",
"11678645314796830121860039367616351726",
"89193860538943321392285885013240521522",
"91096608267985731790498273812193229431",
"26305735412698276699521032109435294040",
"95993125280897136601552422530167304367",
"164110937200694638450800782223286989696",
"16127891518108793295603296767063464211",
"315901859757101403273597886331562269752",
"231406466824361183150462092579442007923",
"338647972012040170870384485242938697844",
"174602275687692149902175874130999907020",
"76222849795276791079198889116606489148",
"143872109281492524104618201388942223607",
"290998123202248475849764547453070213615",
"269471914259567044716363203524461855705",
"313541592876228578104218890929768789440",
"283184454414911039917831315509541652669",
"68356392353622129976776700075451544212",
"1468411265760035873724644932274758480",
"239000323737631796328476385851283960774",
"70378070346519502317151724230760989863"
]
},
"id": "CVE-2023-53199-dbf8a96f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f26dd69f61eff2eedf5df2d199bdd23108309947",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
}
},
{
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"5455752170813321545408535211124337246",
"225674242930134553640937099335933263907",
"307305875101941146045144167432453262891",
"186861900966454046983306299129705359715",
"36838939484097493668703015453741648798",
"307777164169940514981648498641048357549",
"88440626311447334904801279777636423483",
"236805071918882923718013761746608924690",
"237083481102420187976108106489805695668",
"304086709907512737928277504535885893448",
"308818338827502333582722761400230153031",
"189777857103932016589859667805187267486",
"11678645314796830121860039367616351726",
"89193860538943321392285885013240521522",
"91096608267985731790498273812193229431",
"26305735412698276699521032109435294040",
"95993125280897136601552422530167304367",
"164110937200694638450800782223286989696",
"16127891518108793295603296767063464211",
"315901859757101403273597886331562269752",
"231406466824361183150462092579442007923",
"338647972012040170870384485242938697844",
"174602275687692149902175874130999907020",
"76222849795276791079198889116606489148",
"143872109281492524104618201388942223607",
"290998123202248475849764547453070213615",
"269471914259567044716363203524461855705",
"313541592876228578104218890929768789440",
"283184454414911039917831315509541652669",
"68356392353622129976776700075451544212",
"1468411265760035873724644932274758480",
"239000323737631796328476385851283960774",
"70378070346519502317151724230760989863"
]
},
"id": "CVE-2023-53199-e75999d1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61490d2710277e8a55009b7682456ae22f8087cf",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53199.json"