Critical Vulnerability in Linux Package: Non-mmio Device WED Status Check Bypass
Summary
DEBIAN-CVE-2023-53086: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: connac: do not check WED status for non-mmio devices WED is supported just for mmio devices, so do not check it for usb or sdio devices. Affects linux versions < 6.3.7-1. Fixed in 6.3.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, responsible for managing hardware interactions and system resources. It provides essential functionalities for various applications and services running on the system. The package is widely used across different environments, making its security paramount. This vulnerability specifically affects the handling of WED (Wireless Enhanced Data) status checks for non-mmio devices, which could lead to system crashes and potential exploitation.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the WED status is incorrectly checked for non-mmio devices such as USB or SDIO devices. This oversight can lead to a crash when the kernel attempts to execute a non-executable memory page, resulting in a permissions violation. The vulnerability is rooted in the handling of authentication and association processes for wireless connections, potentially allowing an attacker to exploit the system during these operations.
How To Fix
Minimum fixed version
6.3.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using non-mmio devices for wireless connections until the package is updated. Additionally, monitoring system logs for any unusual activity during wireless authentication processes may help mitigate potential exploitation.
Conclusion
The identified vulnerability in the Linux package poses significant risks, particularly for systems utilizing non-mmio devices. It is crucial for users to update to the patched version 6.3.7-1 to mitigate these risks. Utilizing Vulert can further assist in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and potential exploitation during wireless authentication and association processes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, consider using non-mmio devices for wireless connections as a temporary workaround.
Yes, this vulnerability affects specific versions of the Linux package in Debian 13 and 14 prior to the patch version 6.3.7-1.
More details can be found in the official CVE report at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53086.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
