CVE-2023-53213

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info->req_len, data from a URB provided by a USB device, is bigger than the size of buffer which is defined as WL_EXTRA_BUF_MAX. Add the size check for req_len/resp_len of assoc_info. Found by a modified version of syzkaller. [ 46.592467][ T7] ================================================================== [ 46.594687][ T7] BUG: KASAN: sl...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= cf2b448852abd47cee21007b8313fbf962bf3c9a < ac5305e5d227b9af3aae25fa83380d3ff0225b73, >= cf2b448852abd47cee21007b8313fbf962bf3c9a < 39f9bd880abac6068bedb24a4e16e7bd26bf92da, >= cf2b448852abd47cee21007b8313fbf962bf3c9a < 425eea395f1f5ae349fb55f7fe51d833a5324bfe, >= cf2b448852abd47cee21007b8313fbf962bf3c9a < 549825602e3e6449927ca1ea1a08fd89868439df, >= cf2b448852abd47cee21007b8313fbf962bf3c9a < 936a23293bbb3332bdf4cdb9c1496e80cb0bc2c8, >= cf2b448852abd47cee21007b8313fbf962bf3c9a < e29661611e6e71027159a3140e818ef3b99f32dd, >= cf2b448852abd47cee21007b8313fbf962bf3c9a < 228186629ea970cc78b7d7d5f593f2d32fddf9f6, >= cf2b448852abd47cee21007b8313fbf962bf3c9a < 21bee3e649d87f78fe8aef6ae02edd3d6f310fd0, >= cf2b448852abd47cee21007b8313fbf962bf3c9a < 0da40e018fd034d87c9460123fa7f897b69fdee7, >= 2.6.37, < 4.14.315, >= 4.15 < 4.19.283, >= 4.20 < 5.4.243, >= 5.5 < 5.10.180, >= 5.11 < 5.15.110, >= 5.16 < 6.1.27, >= 6.2 < 6.2.14, >= 6.3 < 6.3.1

Fixed versions

4.14.315, 4.19.283, 5.4.243, 5.10.180, 5.15.110, 6.1.27, 6.2.14, 6.3.1

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-125