CVE-2023-52531

Updated: 2024-12-12 00:48:36.747483

Description:

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine. At the end of this structure, there is the 'channels' flex array. Each element is of type 'struct ieee80211_channel'. So only 1 element is allocated in this array. When doing: mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels; We point at the first element of the 'channels' flex array. So this is fine. However, when doing: mvm->nvm_data->bands[0].bitrates = (void *)((u8 *)mvm->nvm_data->channels + 1); because of the "(u8 *)" cast, we add only 1 to the address of the beginning of the flex array. It is likely that we want point at the 'struct ieee80211_rate' allocated just after. Remove the spurious casting so that the pointer arithmetic works as expected.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x 0
CVSS Version 3.x HIGH 7.8

Status

OS name Project name Version Score Severity Status Errata Last updated

Statement

AlmaLinux 9.2 ESU kernel 5.14.0 7.8 HIGH Released CLSA-2025:1738671431 2025-02-05 02:21:25
AlmaLinux 9.2 FIPS kernel 5.14.0 7.8 HIGH Released CLSA-2025:1738670922 2025-02-05 02:21:27
CentOS 8.4 ELS kernel 4.18.0 7.8 HIGH In Testing CLSA-2025:1736778412 2025-02-01 23:54:59
CentOS 8.5 ELS kernel 4.18.0 7.8 HIGH In Testing CLSA-2025:1736778632 2025-02-11 00:36:50
Ubuntu 16.04 ELS linux-hwe 4.15.0 7.8 HIGH Released CLSA-2024:1733484110 2025-02-07 06:40:11
Ubuntu 16.04 ELS linux 4.4.0 7.8 HIGH Released CLSA-2025:1736470237 2025-02-07 06:40:10
Ubuntu 18.04 ELS linux 4.15.0 7.8 HIGH Released CLSA-2024:1733483766 2025-02-07 06:40:12