CVE-2023-1380: High severity redhat Enterprise Linux vulnerability
A slab-out-of-bound read problem was found in brcmfgetassocies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when associnfo->reqlen data is bigger than the size of the buffer, defined as WLEXTRABUFMAX, leading to a denial of service.
Other sources
A slab-out-of-bounds read bug in the Broadcom Full MAC Wi-Fi driver (e.g., brcmfmac.ko in the linux-modules-extra package in Ubuntu).
The bug occurs in kmemdup() called from brcmfgetassocies(), when associnfo->reqlen, data from a URB provided by a USB device, is bigger than the size of buffer which is defined as WLEXTRABUFMAX. The driver duplicates the data of cfg->extrabuf to conninfo->reqie as much as associnfo->reqle, which could exceed the size of the buffer. The data passes through cfg80211connectdone(), cfg80211connectresult(); in the end, it reaches nl80211sendconnectresult() that will form netlink messages with the data read outside the bounds of the buffer. This data, which may contain sensitive information in the kernel, could be sent to a userspace socket by netlinksendskb() during this multicasting process.
Reference: https://lore.kernel.org/linux-wireless/20230309104457.22628-1-jisoo.jang@yonsei.ac.kr/T/#u
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1380?
CVE-2023-1380 is classified as a high severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2023-1380?
To fix CVE-2023-1380, upgrade to the appropriate kernel version as specified in the vulnerability documentation.
What systems are affected by CVE-2023-1380?
CVE-2023-1380 affects various versions of the Linux Kernel, particularly those prior to specific versions such as 4.14.315 and 5.15.110.
What type of vulnerability is CVE-2023-1380?
CVE-2023-1380 is a slab-out-of-bounds read vulnerability found in the brcmf_get_assoc_ies function of the Linux Kernel.
Can CVE-2023-1380 lead to data breaches?
While CVE-2023-1380 primarily leads to denial of service, it may also create opportunities for further exploitation in a compromised system.