CVE-2023-52594: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9khtctxstatus()
Fix an array-index-out-of-bounds read in ath9khtctxstatus(). The bug occurs when txs->cnt, data from a URB provided by a USB device, is bigger than the size of the array txs->txstatus, which is HTCMAXTXSTATUS. WARNON() already checks it, but there is no bug handling code after the check. Make the function return if that is the case.
Found by a modified version of syzkaller.
UBSAN: array-index-out-of-bounds in htcdrvtxrx.c index 13 is out of range for type 'wmieventtxstatus [12]' Call Trace: ath9khtctxstatus ath9kwmieventtasklet taskletactioncommon dosoftirq irqexitrxu sysvecapictimerinterrupt
Other sources
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9khtctxstatus()
The Linux kernel CVE team has assigned CVE-2023-52594 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024030645-CVE-2023-52594-9b84@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by an array-index-out-of-bounds read in ath9khtctxstatus(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52594?
CVE-2023-52594 is classified as a medium severity vulnerability due to potential array-index-out-of-bounds read which may lead to information disclosure.
How do I fix CVE-2023-52594?
To fix CVE-2023-52594, update the kernel package to version 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, or 6.8 as applicable.
What types of systems are affected by CVE-2023-52594?
CVE-2023-52594 affects systems running specific versions of the Linux kernel, particularly versions prior to 6.8.
Is there a workaround for CVE-2023-52594?
There is no known workaround for CVE-2023-52594; the recommended action is to upgrade to the patched kernel versions.
When was CVE-2023-52594 discovered?
CVE-2023-52594 was announced as resolved in the Linux kernel updates released in early 2023.