In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: Fix integer overflow in iwlwritetouserbuf
An integer overflow occurs in the iwlwritetouserbuf() function, which is called by the iwldbgfsmonitordataread() function.
static bool iwlwritetouserbuf(char _user *userbuf, ssizet count, void *buf, ssizet *size, ssizet *bytescopied) { int bufsizeleft = count - *bytes_copied;
buf_size_left = buf_size_left - (buf_size_left % sizeof(u32));
if (*size > buf_size_left)
*size = buf_size_left;
If the user passes a SIZEMAX value to the "ssizet count" parameter, the ssizet count parameter is assigned to "int bufsizeleft". Then compare "*size" with "bufsizeleft" . Here, "bufsizeleft" is a negative number, so "*size" is assigned "bufsizeleft" and goes into the third argument of the copyto_user function, causing a heap overflow.
This is not a security vulnerability because iwldbgfsmonitordataread() is a debugfs operation with 0400 privileges.
{ "vanir_signatures": [ { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ad8dd870aa187d0c21d032bb2c6433559075eec", "signature_type": "Line", "target": { "file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c" }, "deprecated": false, "digest": { "line_hashes": [ "223650311743821455302424846584948369681", "281168513480754725218327874086312179315", "311603698923447923789403856862341496846", "146983635744281497249304034160225535529" ], "threshold": 0.9 }, "id": "CVE-2023-53524-36708072" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82f877ec9b041edc4c7c509c605cc3393d837bf0", "signature_type": "Line", "target": { "file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c" }, "deprecated": false, "digest": { "line_hashes": [ "223650311743821455302424846584948369681", "281168513480754725218327874086312179315", "311603698923447923789403856862341496846", "146983635744281497249304034160225535529" ], "threshold": 0.9 }, "id": "CVE-2023-53524-77f15179" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@059e426d666a41e26b184c177c1ca3ee2d6fa1b6", "signature_type": "Line", "target": { "file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c" }, "deprecated": false, "digest": { "line_hashes": [ "223650311743821455302424846584948369681", "281168513480754725218327874086312179315", "311603698923447923789403856862341496846", "146983635744281497249304034160225535529" ], "threshold": 0.9 }, "id": "CVE-2023-53524-95c317ad" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58d1b717879bfeabe09b35e41ad667c79933eb2e", "signature_type": "Line", "target": { "file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c" }, "deprecated": false, "digest": { "line_hashes": [ "223650311743821455302424846584948369681", "281168513480754725218327874086312179315", "311603698923447923789403856862341496846", "146983635744281497249304034160225535529" ], "threshold": 0.9 }, "id": "CVE-2023-53524-a36ee6b4" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb1ef44efac797b384d361a76e33f77027c29a14", "signature_type": "Line", "target": { "file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c" }, "deprecated": false, "digest": { "line_hashes": [ "223650311743821455302424846584948369681", "281168513480754725218327874086312179315", "311603698923447923789403856862341496846", "146983635744281497249304034160225535529" ], "threshold": 0.9 }, "id": "CVE-2023-53524-d2efa188" }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de78456976026102babe66258c228691ca5677c0", "signature_type": "Line", "target": { "file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c" }, "deprecated": false, "digest": { "line_hashes": [ "223650311743821455302424846584948369681", "281168513480754725218327874086312179315", "311603698923447923789403856862341496846", "146983635744281497249304034160225535529" ], "threshold": 0.9 }, "id": "CVE-2023-53524-ecbe9a36" } ] }