wifi: mt7601u: fix an integer underflow
In the Linux kernel, the following vulnerability has been resolved: wifi: mt7601u: fix an integer underflow Fix an integer underflow that leads to a null pointer dereference in 'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet could be manipulated, which could trigger an integer underflow of 'seg_len' in 'mt7601u_rx_process_seg()'. This underflow subsequently causes the 'bad_frame' checks in 'mt7601u_rx_skb_from_seg()' to be bypassed, eventually leading to a dereference of the pointer 'p', which is a null pointer. Ensure that 'dma_len' is greater than 'min_seg_len'. Found by a modified version of syzkaller. KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G W O 5.14.0+ #139 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 RIP: 0010:skb_add_rx_frag+0x143/0x370 Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 FS: 0
CVE-2023-53679
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-53679
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
"lessThan": "67e4519afba215199b6dfa39ce5d7ea673ee4138",
"versionType": "git"
},
{
"status": "affected",
"version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
"lessThan": "47dc1f425af57b71111d7b01ebd24e04e8d967ef",
"versionType": "git"
},
{
"status": "affected",
"version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
"lessThan": "1a1f43059afae5cc9409e0c3bc63bfc09bc8facb",
"versionType": "git"
},
{
"status": "affected",
"version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
"lessThan": "61d0163e2be7a439cf6f82e9ad7de563ecf41e7a",
"versionType": "git"
},
{
"status": "affected",
"version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
"lessThan": "d0db59e2f718d1e2f1d2a2d8092168fdd2f3add0",
"versionType": "git"
},
{
"status": "affected",
"version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
"lessThan": "803f3176c5df3b5582c27ea690f204abb60b19b9",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/wireless/mediatek/mt7601u/dma.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.235",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.99",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver",
"lessThanOrEqual": "6.2.*"
},
{
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/wireless/mediatek/mt7601u/dma.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-53679
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30306 · Revision 1
- Added to Heist Feed
- Publisher date