CVE-2023-54300
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should validate pkt_len before accessing the SKB. For example, the obtained SKB may have been badly constructed with pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr but after being processed in ath9k_htc_rx_msg() and passed to ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI command header which should be located inside its data payload. Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit memory can be referenced. Tested on Qualcomm Atheros Communications AR9271 802.11n . Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Affected versions
Linux kernel versions
2.6.35
and later are affected. Fixed in
4.14.322,
4.19.291,
5.4.251,
5.10.188,
5.15.121,
6.1.39,
6.3.13,
6.4.4,
6.5
and their respective stable series.
References
The following references provide additional information about CVE-2023-54300 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/0bc12e41af4e3ae1f0efecc377f0514459df0707
-
PatchKernel patch commithttps://git.kernel.org/stable/c/250efb4d3f5b32a115ea6bf25437ba44a1b3c04f
-
PatchKernel patch commithttps://git.kernel.org/stable/c/28259ce4f1f1f9ab37fa817756c89098213d2fc0
Frequently asked questions
-
What is CVE-2023-54300?
CVE-2023-54300 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.35 onward and has been patched in 4.14.322, 4.19.291, 5.4.251 and others. CVE-2023-54300 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2023-54300?
Yes — CVE-2023-54300 has been patched. Fixed versions include 4.14.322, 4.19.291, 5.4.251 and others. If you are running Linux kernel 2.6.35 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2023-54300 actively exploited?
No — CVE-2023-54300 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.