In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: Fix integer overflow in iwlwritetouserbuf
An integer overflow occurs in the iwlwritetouserbuf() function, which is called by the iwldbgfsmonitordataread() function.
static bool iwlwritetouserbuf(char _user *userbuf, ssizet count, void *buf, ssizet *size, ssizet *bytescopied) { int bufsizeleft = count - *bytes_copied;
buf_size_left = buf_size_left - (buf_size_left % sizeof(u32));
if (*size > buf_size_left)
*size = buf_size_left;
If the user passes a SIZEMAX value to the "ssizet count" parameter, the ssizet count parameter is assigned to "int bufsizeleft". Then compare "*size" with "bufsizeleft" . Here, "bufsizeleft" is a negative number, so "*size" is assigned "bufsizeleft" and goes into the third argument of the copyto_user function, causing a heap overflow.
This is not a security vulnerability because iwldbgfsmonitordataread() is a debugfs operation with 0400 privileges.
[
{
"deprecated": false,
"id": "CVE-2023-53524-36708072",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ad8dd870aa187d0c21d032bb2c6433559075eec",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"223650311743821455302424846584948369681",
"281168513480754725218327874086312179315",
"311603698923447923789403856862341496846",
"146983635744281497249304034160225535529"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2023-53524-77f15179",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82f877ec9b041edc4c7c509c605cc3393d837bf0",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"223650311743821455302424846584948369681",
"281168513480754725218327874086312179315",
"311603698923447923789403856862341496846",
"146983635744281497249304034160225535529"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2023-53524-95c317ad",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@059e426d666a41e26b184c177c1ca3ee2d6fa1b6",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"223650311743821455302424846584948369681",
"281168513480754725218327874086312179315",
"311603698923447923789403856862341496846",
"146983635744281497249304034160225535529"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2023-53524-a36ee6b4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58d1b717879bfeabe09b35e41ad667c79933eb2e",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"223650311743821455302424846584948369681",
"281168513480754725218327874086312179315",
"311603698923447923789403856862341496846",
"146983635744281497249304034160225535529"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2023-53524-d2efa188",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb1ef44efac797b384d361a76e33f77027c29a14",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"223650311743821455302424846584948369681",
"281168513480754725218327874086312179315",
"311603698923447923789403856862341496846",
"146983635744281497249304034160225535529"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2023-53524-ecbe9a36",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de78456976026102babe66258c228691ca5677c0",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/pcie/trans.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"223650311743821455302424846584948369681",
"281168513480754725218327874086312179315",
"311603698923447923789403856862341496846",
"146983635744281497249304034160225535529"
],
"threshold": 0.9
}
}
]