CVE-2023-52827

wifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats()

Severity Score

7.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats()

len is extracted from HTT message and could be an unexpected value in
case errors happen, so add validation before using to avoid possible
out-of-bound read in the following message iteration and parsing.

The same issue also applies to ppdu_info->ppdu_stats.common.num_users,
so validate it before using too.

These are found during code review.

Compile test only.

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: wifi: ath12k: corrige una posible lectura fuera de los límites en ath12k_htt_pull_ppdu_stats(). len se extrae del mensaje HTT y podría ser un valor inesperado en caso de que ocurran errores, así que agregue validación antes de usarlo para evitar una posible lectura fuera de los límites en la siguiente iteración y análisis del mensaje. El mismo problema también se aplica a ppdu_info->ppdu_stats.common.num_users, así que valídelo antes de usarlo también. Estos se encuentran durante la revisión del código. Compilar prueba únicamente.

*Credits: N/A

CVSS Scores

NISTv3.1 7.1

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-21 CVE Reserved
2024-05-21 CVE Published
2024-05-24 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-125: Out-of-bounds Read

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/79527c21a3ce04cffc35ea54f74ee087e532be57	2023-11-28
https://git.kernel.org/stable/c/c9e44111da221246efb2e623ae1be40a5cf6542c	2023-11-28
https://git.kernel.org/stable/c/1bc44a505a229bb1dd4957e11aa594edeea3690e	2023-09-20

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.5.13 Search vendor "Linux" for product "Linux Kernel" and version " < 6.5.13"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.6.3 Search vendor "Linux" for product "Linux Kernel" and version " < 6.6.3"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.7 Search vendor "Linux" for product "Linux Kernel" and version " < 6.7"		en		Affected