CVE-2023-52832: wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't return unset power in ieee80211gettxpower()
We can get a UBSAN warning if ieee80211gettxpower() returns the INTMIN value mac80211 internally uses for "unset power level".
UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5 -2147483648 100 cannot be represented in type 'int' CPU: 0 PID: 20433 Comm: insmod Tainted: G WC OE Call Trace: dumpstack+0x74/0x92 ubsanepilogue+0x9/0x50 handleoverflow+0x8d/0xd0 ubsanhandlemuloverflow+0xe/0x10 nl80211sendiface+0x688/0x6b0 [cfg80211] [...] cfg80211registerwdev+0x78/0xb0 [cfg80211] cfg80211netdevnotifiercall+0x200/0x620 [cfg80211] [...] ieee80211ifadd+0x60e/0x8f0 [mac80211] ieee80211registerhw+0xda5/0x1170 [mac80211]
In this case, simply return an error instead, to indicate that no data is available.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't return unset power in ieee80211gettxpower()
The Linux kernel CVE team has assigned CVE-2023-52832 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052108-CVE-2023-52832-b9d9@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52832?
CVE-2023-52832 is classified as a potential integrity vulnerability within the Linux kernel.
How do I fix CVE-2023-52832?
To resolve CVE-2023-52832, update the Linux kernel to versions 4.14.331, 4.19.300, 5.4.262, 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, or 6.7 as appropriate.
Which Linux kernel versions are affected by CVE-2023-52832?
CVE-2023-52832 affects multiple Linux kernel versions including those prior to 4.14.331, 4.19.300, 5.4.262, 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7.
What happens if CVE-2023-52832 is exploited?
Exploiting CVE-2023-52832 could lead to a potentially undefined behavior or a warning from UBSAN when the power level is not set.
Is CVE-2023-52832 specific to any distribution?
CVE-2023-52832 primarily affects the Red Hat distribution of the Linux kernel but can impact any system using the vulnerable kernel versions.