CVE-2023-52832 wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
A signed integer overflow in the Linux kernel Wi-Fi subsystem can cause a UBSAN warning and potential system instability when retrieving unset power levels.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52832?
CVE-2023-52832 is a critical vulnerability in Linux kernel, published on 21 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
We can get a UBSAN warning if ieee80211_get_tx_power() returns the INT_MIN value mac80211 internally uses for "unset power level".
UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5 -2147483648 * 100 cannot be represented in type 'int' CPU: 0 PID: 20433 Comm: insmod Tainted: G WC OE Call Trace: dump_stack+0x74/0x92 ubsan_epilogue+0x9/0x50 handle_overflow+0x8d/0xd0 __ubsan_handle_mul_overflow+0xe/0x10 nl80211_send_iface+0x688/0x6b0 [cfg80211] [...] cfg80211_register_wdev+0x78/0xb0 [cfg80211] cfg80211_netdev_notifier_call+0x200/0x620 [cfg80211] [...] ieee80211_if_add+0x60e/0x8f0 [mac80211] ieee80211_register_hw+0xda5/0x1170 [mac80211]
In this case, simply return an error instead, to indicate that no data is available.
Weakness: CWE-920
Which versions are affected by CVE-2023-52832?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52832?
Apply the vendor's patch.
Is CVE-2023-52832 being exploited?
There is no known exploitation of CVE-2023-52832 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52832, DEBIAN-CVE-2023-52832, GHSA-9hhf-j948-m466, UBUNTU-CVE-2023-52832.