CVE-2023-52832 - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()

Back Back to CVE browser

CRITICAL

wifi: mac80211: don't return unset power in ieee80211_get_tx_power()

Published May 21, 2024

9.1

CRITICAL

CVSS 3.1

EPSS 1.26%

Description

We can get a UBSAN warning if ieee80211_get_tx_power() returns the INT_MIN value mac80211 internally uses for "unset power level".

UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5 -2147483648 * 100 cannot be represented in type 'int' CPU: 0 PID: 20433 Comm: insmod Tainted: G WC OE Call Trace: dump_stack+0x74/0x92 ubsan_epilogue+0x9/0x50 handle_overflow+0x8d/0xd0 __ubsan_handle_mul_overflow+0xe/0x10 nl80211_send_iface+0x688/0x6b0 [cfg80211] [...] cfg80211_register_wdev+0x78/0xb0 [cfg80211] cfg80211_netdev_notifier_call+0x200/0x620 [cfg80211] [...] ieee80211_if_add+0x60e/0x8f0 [mac80211] ieee80211_register_hw+0xda5/0x1170 [mac80211]

In this case, simply return an error instead, to indicate that no data is available.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  5.7
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <5.7
- Version
  5.10.202
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.140
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  6.1.64
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.5.13
  Status
  unaffected
  Constraints
  <=6.5.*
- Version
  6.6.3
  Status
  unaffected
  Constraints
  <=6.6.*
- Version
  6.7
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
5.7	affected	-
0	unaffected	<5.7
5.10.202	unaffected	<=5.10.*
5.15.140	unaffected	<=5.15.*
6.1.64	unaffected	<=6.1.*
6.5.13	unaffected	<=6.5.*
6.6.3	unaffected	<=6.6.*
6.7	unaffected	<=*

Vendor Linux Product Linux Kernel Default
n/a
- Version
  1da177e4c3f4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

Linux Kernel

n/a

Version	Status	Constraints
1da177e4c3f4	affected	-

Red Hat Enterprise Linux 8

kernel-0:4.18.0-553.16.1.el8_10

Fixed · RHSA-2024:5101
Red Hat Enterprise Linux 8

kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10

Fixed · RHSA-2024:5102
Red Hat Enterprise Linux 9

kernel-0:5.14.0-427.13.1.el9_4

Fixed · RHSA-2024:2394
Red Hat Enterprise Linux 9

kernel-0:5.14.0-427.13.1.el9_4

Fixed · RHSA-2024:2394
Red Hat Enterprise Linux 6

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel-rt

Out of support scope
Red Hat Enterprise Linux 9

kernel-rt

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	kernel-0:4.18.0-553.16.1.el8_10	Fixed	RHSA-2024:5101
Red Hat Enterprise Linux 8	kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10	Fixed	RHSA-2024:5102
Red Hat Enterprise Linux 9	kernel-0:5.14.0-427.13.1.el9_4	Fixed	RHSA-2024:2394
Red Hat Enterprise Linux 9	kernel-0:5.14.0-427.13.1.el9_4	Fixed	RHSA-2024:2394
Red Hat Enterprise Linux 6	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel-rt	Out of support scope	n/a
Red Hat Enterprise Linux 9	kernel-rt	Will not fix	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-190

Integer Overflow

CWE-920

References (15)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-52832		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2282645		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59546		Advisory
https://git.kernel.org/stable/c/1571120c44dbe5757aee1612c5b6097cdc42710f		Patch
https://git.kernel.org/stable/c/21a0f310a9f3bfd2b4cf4f382430e638607db846		Patch
https://git.kernel.org/stable/c/298e767362cade639b7121ecb3cc5345b6529f62		Patch
https://git.kernel.org/stable/c/2be24c47ac19bf639c48c082486c08888bd603c6		Patch
https://git.kernel.org/stable/c/5a94cffe90e20e8fade0b9abd4370bd671fe87c7		Patch
https://git.kernel.org/stable/c/717de20abdcd1d4993fa450e28b8086a352620ea		Patch
https://git.kernel.org/stable/c/adc2474d823fe81d8da759207f4f1d3691aa775a		Patch
https://git.kernel.org/stable/c/e160ab85166e77347d0cbe5149045cb25e83937f		Patch
https://git.kernel.org/stable/c/efeae5f4972f75d50002bc50eb112ab9e7069b18		Patch
https://lore.kernel.org/linux-cve-announce/2024052108-CVE-2023-52832-b9d9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-52832
https://www.cve.org/CVERecord?id=CVE-2023-52832