Junglewise Threat Intelligence

CVE-2023-47233: Linux Kernel brcm80211 use-after-free in brcmf_cfg80211_detach

CVE-2023-47233 · Severity: medium · CVSS 4.3 · Published 2023-11-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Broadcom wireless driver within the Linux kernel, which manages Wi-Fi connectivity for many devices. An attacker with physical access to a computer could potentially cause a system crash or instability by rapidly unplugging a Broadcom-based USB Wi-Fi adapter. This issue primarily impacts system availability and could lead to a denial-of-service scenario on affected machines.

Technical details

A use-after-free (UAF) vulnerability exists in the brcm80211 driver (specifically the brcmfmac component) due to a race condition during USB device disconnection. When a Broadcom USB Wi-Fi device is unplugged, the 'brcmf_cfg80211_detach' function frees the configuration structure ('cfg'); however, a scheduled timeout worker ('brcmf_cfg80211_escan_timeout_worker') may still be running or queued, leading to a UAF when it attempts to access the freed memory. This requires physical proximity to perform a hotplug action. The vulnerability was fixed by ensuring the timer is deleted and the work queue is synchronized/canceled before the memory is released.

Affected products

  • Linux Linux Kernel up to and including 6.5.10

Timeline

  • 2023-10-30: disclosed: Vulnerability reported to SUSE by Zheng Wang via static analysis.
  • 2023-11-03: advisory: NVD published the CVE record.
  • 2024-01-18: patched: Fix committed to the mainline Linux kernel.

References

Related threats