Executive brief
The Intel WiFi driver in the Linux kernel did not properly validate firmware responses when processing mobile country code (MCC) updates. An attacker with the ability to supply a malicious firmware or intercept firmware communications could cause the kernel to read uninitialized memory or crash, potentially exposing sensitive system data or disrupting WiFi connectivity.
Technical details
The vulnerability is a buffer over-read in the iwlwifi driver's MCC update handler (drivers/net/wireless/intel/iwlwifi/mvm/nvm.c). The code trusted the n_channels field from the firmware response without validating that the actual payload size matched the claimed channel count. An attacker controlling or corrupting the firmware response could specify an n_channels value much larger than the one-page buffer allocated for the response, causing the kernel to copy uninitialized memory into a heap buffer or exceed page boundaries and crash. The fix adds a strict length validation check comparing the actual payload size against the expected size calculated from the n_channels value before processing the response. No user interaction or authentication is required; the attack vector is at the firmware/device level.
Affected products
- Linux Linux kernel all versions with iwlwifi driver
Timeline
- 2023-05-24: disclosed: Patch committed upstream as 682b6dc29d98e857e6ca4bbc077c7dc2899b7473
- 2023-10-04: other: CVE-2023-53589 assigned