In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: Fix potential stack-out-of-bounds write in ath9kwmirsp_callback()
Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9kwmicmd(). The callback writes to wmi->cmdrspbuf, a stack-allocated buffer that could no longer be valid when a timeout occurs. Set wmi->lastseqid to 0 when a timeout occurred.
Found by a modified version of syzkaller.
BUG: KASAN: stack-out-of-bounds in ath9kwmictrlrx Write of size 4 Call Trace: memcpy ath9kwmictrlrx ath9khtcrxmsg ath9khifusbregincb _usbhcdgivebackurb usbhcdgivebackurb dummytimer calltimerfn runtimersoftirq _dosoftirq irqexitrcu sysvecapictimer_interrupt
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53717.json"
}[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"301042003442487289487448743035418906654",
"18419910864274664985311281451749111310",
"175155817840329244673204529185869991731",
"311508480701693846295978988253434578643"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1af7eacfad45149c54893a8a9df9e92ef89f0a90",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-1eb43c91"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"301042003442487289487448743035418906654",
"18419910864274664985311281451749111310",
"91445866362555466572138086795562618507",
"320543537097004838715602861376673831866"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae4933b4f17de8e2b7ff6f91b17d3b0099a6d6bc",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-24663eb9"
},
{
"digest": {
"function_hash": "314119507099095205068429931671192264437",
"length": 1181.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae4933b4f17de8e2b7ff6f91b17d3b0099a6d6bc",
"signature_type": "Function",
"target": {
"function": "ath9k_wmi_cmd",
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-2cd1719e"
},
{
"digest": {
"function_hash": "105586128187382028024297422536823745544",
"length": 1162.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78b56b0a613a87b61290b95be497fdfe2fe58aa6",
"signature_type": "Function",
"target": {
"function": "ath9k_wmi_cmd",
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-370e6ee0"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"301042003442487289487448743035418906654",
"18419910864274664985311281451749111310",
"175155817840329244673204529185869991731",
"311508480701693846295978988253434578643"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@554048a72d7ecfdd58cc1bfb56e0a1864e64e82c",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-44e6a3e2"
},
{
"digest": {
"function_hash": "105586128187382028024297422536823745544",
"length": 1162.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1af7eacfad45149c54893a8a9df9e92ef89f0a90",
"signature_type": "Function",
"target": {
"function": "ath9k_wmi_cmd",
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-62f1c13c"
},
{
"digest": {
"function_hash": "314119507099095205068429931671192264437",
"length": 1181.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89a33c3c847b19b19205cde1d924df2a6c70d8eb",
"signature_type": "Function",
"target": {
"function": "ath9k_wmi_cmd",
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-64d94434"
},
{
"digest": {
"function_hash": "105586128187382028024297422536823745544",
"length": 1162.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a2f35b9830692f7a616f2f627f943bc748af13a",
"signature_type": "Function",
"target": {
"function": "ath9k_wmi_cmd",
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-7ff0ad08"
},
{
"digest": {
"function_hash": "105586128187382028024297422536823745544",
"length": 1162.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f28513d9520184059530c01a9f928a1b3809d3f",
"signature_type": "Function",
"target": {
"function": "ath9k_wmi_cmd",
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-b48e6872"
},
{
"digest": {
"function_hash": "105586128187382028024297422536823745544",
"length": 1162.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@554048a72d7ecfdd58cc1bfb56e0a1864e64e82c",
"signature_type": "Function",
"target": {
"function": "ath9k_wmi_cmd",
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-c0530561"
},
{
"digest": {
"function_hash": "105586128187382028024297422536823745544",
"length": 1162.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf6dc175a2b53098a69db1236d9d53982f4b1bc0",
"signature_type": "Function",
"target": {
"function": "ath9k_wmi_cmd",
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-c7db584d"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"301042003442487289487448743035418906654",
"18419910864274664985311281451749111310",
"175155817840329244673204529185869991731",
"311508480701693846295978988253434578643"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a2f35b9830692f7a616f2f627f943bc748af13a",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-cc344677"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"301042003442487289487448743035418906654",
"18419910864274664985311281451749111310",
"175155817840329244673204529185869991731",
"311508480701693846295978988253434578643"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf6dc175a2b53098a69db1236d9d53982f4b1bc0",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-cd778367"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"301042003442487289487448743035418906654",
"18419910864274664985311281451749111310",
"175155817840329244673204529185869991731",
"311508480701693846295978988253434578643"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78b56b0a613a87b61290b95be497fdfe2fe58aa6",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-d286295a"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"301042003442487289487448743035418906654",
"18419910864274664985311281451749111310",
"175155817840329244673204529185869991731",
"311508480701693846295978988253434578643"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f28513d9520184059530c01a9f928a1b3809d3f",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-dc1feeec"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"301042003442487289487448743035418906654",
"18419910864274664985311281451749111310",
"91445866362555466572138086795562618507",
"320543537097004838715602861376673831866"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89a33c3c847b19b19205cde1d924df2a6c70d8eb",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath9k/wmi.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53717-f2e37800"
}
]