Executive brief
The Intel WiFi driver (iwlwifi) in the Linux kernel contains a buffer overflow vulnerability in how it processes TKIP encryption keys received from wireless networks. When a system receives a specially crafted TKIP key of maximum size, the driver copies more data than its destination buffer can hold, causing memory corruption. An attacker on the same network could exploit this to crash the system or potentially execute arbitrary code with kernel privileges.
Technical details
This is a classic buffer overflow (CWE-120) in the iwlagn_send_sta_key() function in drivers/net/wireless/intel/iwlwifi/dvm/sta.c. The vulnerable code attempts to copy an entire TKIP key (up to 32 bytes, including MIC rx/tx keys) into the iwl_keyinfo.key field, which is only 16 bytes in size. The root cause is that the driver does not validate the key length before copying, allowing oversized keys to overflow the fixed-size buffer. The vulnerability is reachable from the wireless MAC80211 subsystem when processing received TKIP encryption keys. The fix adds a bounds check using min_t() to ensure only the maximum supported key size (16 bytes) is copied. The patch has been applied to the stable Linux kernel.
Affected products
- Linux Linux kernel Multiple versions affected; patches available for stable branches
Timeline
- 2023-05: disclosed: Patch released in stable kernel tree May 2023
- 2023-05-24: patched: Fix available in stable branches via commit 57189c885149
- 2025-12-30: advisory: CVE-2023-54286 published