In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Fix a NULL pointer dereference in ath12kmacophwscan()
In ath12kmacophwscan(), the return value of kzalloc() is directly used in memcpy(), which may lead to a NULL pointer dereference on failure of kzalloc().
Fix this bug by adding a check of arg.extraie.ptr.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPLV1.0V2.0_SILICONZ-1.15378.4
[
{
"id": "CVE-2023-53721-5ed8aa14",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ad314da54c6dd223a6b6cc85019160aa842f659",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "ath12k_mac_op_hw_scan",
"file": "drivers/net/wireless/ath/ath12k/mac.c"
},
"digest": {
"function_hash": "133023560391040428074557483283852184209",
"length": 1870.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53721-a2a92090",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a263df398b581189fe632b4ab8440f3dd76c251",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath12k/mac.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"52448726792091396138483193051389064155",
"211654134562658660262426132574575825017",
"300525411789807354053296187151314861246",
"110521751560132410410331664126030252473",
"241365868741976487606047626047216886214",
"152346502872429114417228756144662658854",
"24638502634441471918810140397772100787"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53721-a633b5ce",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ad314da54c6dd223a6b6cc85019160aa842f659",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath12k/mac.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"52448726792091396138483193051389064155",
"211654134562658660262426132574575825017",
"300525411789807354053296187151314861246",
"110521751560132410410331664126030252473",
"241365868741976487606047626047216886214",
"152346502872429114417228756144662658854",
"24638502634441471918810140397772100787"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53721-cc8c3655",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a263df398b581189fe632b4ab8440f3dd76c251",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "ath12k_mac_op_hw_scan",
"file": "drivers/net/wireless/ath/ath12k/mac.c"
},
"digest": {
"function_hash": "133023560391040428074557483283852184209",
"length": 1870.0
},
"signature_type": "Function"
}
]