Out-of-Bound Write Vulnerability in Linux Package: CVE-2023-52829
Summary
DEBIAN-CVE-2023-52829: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps() reg_cap.phy_id is extracted from WMI event and could be an unexpected val... Affects linux versions < 6.6.8-1. Fixed in 6.6.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, enabling communication between software and hardware. The kernel is crucial for system stability and performance. This vulnerability affects the Linux package in Debian versions 13 and 14, specifically in the ath12k Wi-Fi driver, which is responsible for managing wireless communications.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ath12k Wi-Fi driver, specifically in the function ath12k_wmi_ext_hal_reg_caps(). The issue arises when reg_cap.phy_id is extracted from a WMI event, which can potentially yield an unexpected value if errors occur. This can lead to an out-of-bound write to soc->hal_reg_cap, posing a risk of data corruption or system instability. The vulnerability was discovered during a code review and has been classified as a significant concern due to its potential impact on system security and reliability.
How To Fix
Minimum fixed version
6.6.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The CVE-2023-52829 vulnerability in the Linux kernel's ath12k Wi-Fi driver poses a significant risk due to the potential for out-of-bound writes. It is crucial for users of Debian 13 and 14 to update their systems to the patched version 6.6.8-1 to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2023-52829 is a vulnerability in the Linux kernel's ath12k Wi-Fi driver that can lead to an out-of-bound write, potentially causing data corruption.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
The risks include potential data corruption and system instability, which could lead to crashes or unexpected behavior in applications relying on the Wi-Fi driver.
Yes, a patch is available in version 6.6.8-1 of the Linux package for Debian 13 and 14.
You can use tools like Vulert to monitor your applications for vulnerabilities in real-time, ensuring you are alerted to any new issues as they arise.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
