CVE-2023-53679: wifi: mt7601u: fix an integer underflow
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt7601u: fix an integer underflow
Fix an integer underflow that leads to a null pointer dereference in 'mt7601urxskbfromseg()'. The variable 'dmalen' in the URB packet could be manipulated, which could trigger an integer underflow of 'seglen' in 'mt7601urxprocessseg()'. This underflow subsequently causes the 'badframe' checks in 'mt7601urxskbfromseg()' to be bypassed, eventually leading to a dereference of the pointer 'p', which is a null pointer.
Ensure that 'dmalen' is greater than 'minseglen'.
Found by a modified version of syzkaller.
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G W O 5.14.0+ #139 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 RIP: 0010:skbaddrxfrag+0x143/0x370 Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: mt7601urxtasklet+0xc73/0x1270 ? mt7601usubmitrxbuf.isra.0+0x510/0x510 ? taskletactioncommon.isra.0+0x79/0x2f0 taskletactioncommon.isra.0+0x206/0x2f0 dosoftirq+0x1b5/0x880 ? taskletunlock+0x30/0x30 runksoftirqd+0x26/0x50 smpbootthreadfn+0x34f/0x7d0 ? smpbootregisterpercputhread+0x370/0x370 kthread+0x3a1/0x480 ? setkthreadstruct+0x120/0x120 retfromfork+0x1f/0x30 Modules linked in: 88XXau(O) 88x2bu(O) ---[ end trace 57f34f93b4da0f9b ]--- RIP: 0010:skbaddrxfrag+0x143/0x370 Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel wifi: mt7601uto a version that resolves this vulnerability.Fixed in rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014Patch wifi: mt7601u: fix an integer underflow
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53679?
CVE-2023-53679 has been classified as a medium severity vulnerability due to the potential for denial of service resulting from a null pointer dereference.
How do I fix CVE-2023-53679?
To fix CVE-2023-53679, update your Linux kernel to version 5.14.0 or later where the vulnerability has been patched.
What systems are affected by CVE-2023-53679?
CVE-2023-53679 affects the Linux kernel versions from 5.14.0 onwards, specifically impacting devices utilizing the mt7601u driver.
What type of vulnerability is CVE-2023-53679?
CVE-2023-53679 is an integer underflow vulnerability that can lead to a null pointer dereference in the Linux kernel.
Who is responsible for the vulnerability identified in CVE-2023-53679?
The vulnerability CVE-2023-53679 was addressed by the Linux kernel development team, specifically relating to the mt7601u driver.