CVE-2023-52776

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dfs-radar and temperature event locking The ath12k active pdevs are protected by RCU but the DFS-radar and temperature event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as RCU read-side critical sections to avoid any potential use-after-free issues. Note that the temperature event handler looks like a place holder currently but would still trigger an RCU lockdep splat. Compile tested only.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7	Patch
https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535	Patch
https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e	Patch
https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7	Patch
https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535	Patch
https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

No history.

Information

Published : 2024-05-21 16:15

Updated : 2025-04-02 15:03

NVD link : CVE-2023-52776

Mitre link : CVE-2023-52776

CVE.ORG link : CVE-2023-52776

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-416

Use After Free

{"id": "CVE-2023-52776", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2024-05-21T16:15:16.680", "references": [{"url": "https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix dfs-radar and temperature event locking\n\nThe ath12k active pdevs are protected by RCU but the DFS-radar and\ntemperature event handling code calling ath12k_mac_get_ar_by_pdev_id()\nwas not marked as a read-side critical section.\n\nMark the code in question as RCU read-side critical sections to avoid\nany potential use-after-free issues.\n\nNote that the temperature event handler looks like a place holder\ncurrently but would still trigger an RCU lockdep splat.\n\nCompile tested only."}, {"lang": "es", "value": " En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: corrige el bloqueo de eventos de temperatura y radar dfs. Los pdev activos de ath12k est\u00e1n protegidos por RCU, pero el c\u00f3digo de manejo de eventos de temperatura y radar DFS que llama a ath12k_mac_get_ar_by_pdev_id() no estaba marcado como una secci\u00f3n cr\u00edtica del lado de lectura. Marque el c\u00f3digo en cuesti\u00f3n como secciones cr\u00edticas del lado de lectura de RCU para evitar posibles problemas de use after free. Tenga en cuenta que el controlador de eventos de temperatura actualmente parece un marcador de posici\u00f3n, pero a\u00fan as\u00ed activar\u00eda un bloqueo de bloqueo de RCU. Compilaci\u00f3n probada \u00fanicamente."}], "lastModified": "2025-04-02T15:03:08.370", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81D6709B-8CD5-4054-8AC5-D8C32228FA43", "versionEndExcluding": "6.5.13", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B58252FA-A49C-411F-9B28-DC5FE44BC5A0", "versionEndExcluding": "6.6.3", "versionStartIncluding": "6.6"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}