CVE-2023-50809 Memory corruption in n/a
A stack buffer overflow in the Sonos wireless driver allows remote code execution within the kernel during WPA2 handshake negotiation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-50809?
CVE-2023-50809 is a high-severity memory corruption vulnerability in n/a, published on 9 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an information element during negotiation of a WPA2 four-way handshake. This lack of validation leads to a stack buffer overflow. This can result in remote code execution within the kernel. This affects Amp, Arc, Arc SL, Beam, Beam Gen 2, Beam SL, and Five.
Weakness: CWE-121
Which versions are affected by CVE-2023-50809?
How do I fix CVE-2023-50809?
No fix has been published for CVE-2023-50809 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-50809 being exploited?
There is no known exploitation of CVE-2023-50809 in the wild and no public exploit code.
Sources
Also known as GHSA-23v8-j48f-jm74.