CVE-2023-1380

Published: 27 March 2023

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.

From the Ubuntu Security Team

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose sensitive information.

Notes

wireless-next commit is "wifi: brcmfmac: slab-out-of-bounds
read in brcmf_get_assoc_ies()"

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1380
• https://www.openwall.com/lists/oss-security/2023/03/13/1
• https://lore.kernel.org/linux-wireless/20230309104457.22628-1-jisoo.jang@yonsei.ac.kr/T/#u
• https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git/commit/?h=for-next&id=0da40e018fd034d87c9460123fa7f897b69fdee7
• https://ubuntu.com/security/notices/USN-6127-1
• https://ubuntu.com/security/notices/USN-6130-1
• https://ubuntu.com/security/notices/USN-6131-1
• https://ubuntu.com/security/notices/USN-6132-1
• https://ubuntu.com/security/notices/USN-6135-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2177883
• https://bugzilla.suse.com/show_bug.cgi?id=1209287