In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9khtctxstatus()
Fix an array-index-out-of-bounds read in ath9khtctxstatus(). The bug occurs when txs->cnt, data from a URB provided by a USB device, is bigger than the size of the array txs->txstatus, which is HTCMAXTXSTATUS. WARNON() already checks it, but there is no bug handling code after the check. Make the function return if that is the case.
Found by a modified version of syzkaller.
UBSAN: array-index-out-of-bounds in htcdrvtxrx.c index 13 is out of range for type '_wmieventtxstatus [12]' Call Trace: ath9khtctxstatus ath9kwmieventtasklet taskletactioncommon _dosoftirq irqexitrxu sysvecapictimer_interrupt
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"248861351685514305798886675279177449417",
"100912026702296961317441549724315346365",
"254472524727907811155148239105890506281",
"14453743282544535284924694470364379804",
"277100932592317206534647667412077141112"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2adc886244dff60f948497b59affb6c6ebb3c348",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
},
"id": "CVE-2023-52594-38a53c38"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 654.0,
"function_hash": "47351139179663428102248970413176462147"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25c6f49ef59b7a9b80a3f7ab9e95268a1b01a234",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c",
"function": "ath9k_htc_txstatus"
},
"id": "CVE-2023-52594-4a9fb067"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"248861351685514305798886675279177449417",
"100912026702296961317441549724315346365",
"254472524727907811155148239105890506281",
"14453743282544535284924694470364379804",
"277100932592317206534647667412077141112"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25c6f49ef59b7a9b80a3f7ab9e95268a1b01a234",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c"
},
"id": "CVE-2023-52594-510ae78e"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 654.0,
"function_hash": "47351139179663428102248970413176462147"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2adc886244dff60f948497b59affb6c6ebb3c348",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_drv_txrx.c",
"function": "ath9k_htc_txstatus"
},
"id": "CVE-2023-52594-f06dac25"
}
]