CVE-2023-53524

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: pcie: Fix integer overflow in iwlwritetouserbuf

An integer overflow occurs in the iwlwritetouserbuf() function, which is called by the iwldbgfsmonitordataread() function.

static bool iwlwritetouserbuf(char _user *userbuf, ssizet count, void *buf, ssizet *size, ssizet *bytescopied) { int bufsizeleft = count - *bytes_copied;

buf_size_left = buf_size_left - (buf_size_left % sizeof(u32));
if (*size > buf_size_left)
    *size = buf_size_left;

If the user passes a SIZEMAX value to the "ssizet count" parameter, the ssizet count parameter is assigned to "int bufsizeleft". Then compare "*size" with "bufsizeleft" . Here, "bufsizeleft" is a negative number, so "*size" is assigned "bufsizeleft" and goes into the third argument of the copyto_user function, causing a heap overflow.

This is not a security vulnerability because iwldbgfsmonitordataread() is a debugfs operation with 0400 privileges.