CVE-2023-52768: wifi: wilc1000: use vmm_table as array in wilc struct

Q: What is the severity of CVE-2023-52768?

CVE-2023-52768 has been classified as a moderate severity vulnerability.

Q: How do I fix CVE-2023-52768?

To mitigate the effects of CVE-2023-52768, ensure that the Linux kernel is updated to a version later than 5.15.140, 6.1.64, 6.5.13, or 6.6.3.

Q: What systems are affected by CVE-2023-52768?

CVE-2023-52768 affects various versions of the Linux kernel between 5.15.68 and 5.15.140, as well as versions from 5.19.9 to 6.1.64, from 6.2 to 6.5.13, and from 6.6 to 6.6.3.

Q: What is the impact of CVE-2023-52768?

The impact of CVE-2023-52768 can lead to slab-out-of-bounds write vulnerabilities when running certain memory tests.

Q: Is there a workaround for CVE-2023-52768?

As of now, the best practice is to update the kernel to a fixed version as there are no known workarounds for CVE-2023-52768.

Published May 21, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: use vmmtable as array in wilc struct

Enabling KASAN and running some iperf tests raises some memory issues with vmmtable:

BUG: KASAN: slab-out-of-bounds in wilcwlanhandletxq+0x6ac/0xdb4 Write of size 4 at addr c3a61540 by task wlan0-tx/95

KASAN detects that we are writing data beyond range allocated to vmmtable. There is indeed a mismatch between the size passed to allocator in wilcwlaninit, and the range of possible indexes used later: allocation size is missing a multiplication by sizeof(u32)

Affected Software

118 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=5.15.68<5.15.140

Linux Linux kernel>=5.19.9<6.1.64

Linux Linux kernel>=6.2<6.5.13

Linux Linux kernel>=6.6<6.6.3

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.15<5.15.0-1056.61~20.04.1

5.15.0-1056.61~20.04.1

ubuntu/linux-azure-5.15<5.15.0-1058.66~20.04.2

5.15.0-1058.66~20.04.2

ubuntu/linux-gcp-5.15<5.15.0-1053.61~20.04.1

5.15.0-1053.61~20.04.1

ubuntu/linux-gkeop-5.15<5.15.0-1038.44~20.04.1

5.15.0-1038.44~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-100.110~20.04.1

5.15.0-100.110~20.04.1

ubuntu/linux-ibm-5.15<5.15.0-1048.51~20.04.1

5.15.0-1048.51~20.04.1

ubuntu/linux-intel-iotg-5.15<5.15.0-1050.56~20.04.1

5.15.0-1050.56~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-100.110~20.04.1

5.15.0-100.110~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1025.25~20.04.1

5.15.0-1025.25~20.04.1

ubuntu/linux-oracle-5.15<5.15.0-1053.59~20.04.1

5.15.0-1053.59~20.04.1

ubuntu/linux-riscv-5.15<5.15.0-1051.55~20.04.1

5.15.0-1051.55~20.04.1

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux<5.15.0-100.110

5.15.0-100.110

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1056.61

5.15.0-1056.61

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure<5.15.0-1058.66

5.15.0-1058.66

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde<5.15.0-1058.66.1

5.15.0-1058.66.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1053.61

5.15.0-1053.61

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gke<5.15.0-1052.57

5.15.0-1052.57

ubuntu/linux-gkeop<5.15.0-1038.44

5.15.0-1038.44

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1048.51

5.15.0-1048.51

ubuntu/linux-intel-iotg<5.15.0-1050.56

5.15.0-1050.56

ubuntu/linux-kvm<5.15.0-1052.57

5.15.0-1052.57

ubuntu/linux-lowlatency<5.15.0-100.110

5.15.0-100.110

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia<5.15.0-1046.46

5.15.0-1046.46

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5<6.5.0-1014.14

6.5.0-1014.14

ubuntu/linux-nvidia-tegra<5.15.0-1025.25

5.15.0-1025.25

ubuntu/linux-nvidia-tegra-igx<5.15.0-1012.12

5.15.0-1012.12

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1053.59

5.15.0-1053.59

ubuntu/linux-oracle-6.5*

ubuntu/linux-raspi<5.15.0-1048.51

5.15.0-1048.51

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1030.34

5.15.0-1030.34

ubuntu/linux-bluefield<5.15.0-1037.39

5.15.0-1037.39

ubuntu/linux-intel-iot-realtime<5.15.0-1048.50

5.15.0-1048.50

ubuntu/linux-realtime<5.15.0-1056.63

5.15.0-1056.63

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1056.61+fips1

5.15.0-1056.61+fips1

ubuntu/linux-fips<5.15.0-100.110+fips1

5.15.0-100.110+fips1

ubuntu/linux-gcp-fips<5.15.0-1055.63+fips2

5.15.0-1055.63+fips2

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1056.61~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1058.66~20.04.2
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1053.61~20.04.1
Upgrade
Upgrade ubuntu/linux-gkeop-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1038.44~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-100.110~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1048.51~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1050.56~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-100.110~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.25~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1053.59~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1051.55~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-100.110
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1056.61
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1058.66
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1058.66.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1053.61
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1052.57
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1038.44
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1048.51
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1050.56
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1052.57
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-100.110
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1046.46
Upgrade
Upgrade ubuntu/linux-nvidia-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1014.14
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.25
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1012.12
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1053.59
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1048.51
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.34
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1037.39
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1048.50
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1056.63
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1056.61+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-100.110+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1055.63+fips2

Event History

May 21, 2024

CVE Published

via MITRE·03:30 PM

Data Sourced

via MITRE·03:30 PM

DescriptionSeverity

Data Sourced

via OSV·04:15 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-52768?

CVE-2023-52768 has been classified as a moderate severity vulnerability.

How do I fix CVE-2023-52768?

To mitigate the effects of CVE-2023-52768, ensure that the Linux kernel is updated to a version later than 5.15.140, 6.1.64, 6.5.13, or 6.6.3.

What systems are affected by CVE-2023-52768?

CVE-2023-52768 affects various versions of the Linux kernel between 5.15.68 and 5.15.140, as well as versions from 5.19.9 to 6.1.64, from 6.2 to 6.5.13, and from 6.6 to 6.6.3.

What is the impact of CVE-2023-52768?

The impact of CVE-2023-52768 can lead to slab-out-of-bounds write vulnerabilities when running certain memory tests.

Is there a workaround for CVE-2023-52768?

As of now, the best practice is to update the kernel to a fixed version as there are no known workarounds for CVE-2023-52768.

CVE-2023-52768: wifi: wilc1000: use vmm_table as array in wilc struct

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2023-52768?

How do I fix CVE-2023-52768?

What systems are affected by CVE-2023-52768?

What is the impact of CVE-2023-52768?

Is there a workaround for CVE-2023-52768?

Company

Resources

Contact