CVE-2023-53540

Vulnerability

Description

The Linux kernel's cfg80211 subsystem lacked a check to prevent a station from attempting to authenticate or associate with an access point that uses the station's own MAC address as its BSSID or MLD address. This could occur due to misconfiguration or a malicious AP. The patch adds a sanity check to reject such connections early [1][2][3].

Exploitation

An attacker could set up a rogue AP with the same MAC address as the target client. When the client attempts to connect, the kernel would proceed with the authentication/association process, which would eventually fail or cause unexpected behavior. The attack requires the attacker to be within radio range and have the ability to spoof the client's MAC address as the AP's BSSID.

Impact

Without the fix, the client would waste resources attempting to connect and may experience connection failures or instability. The patch prevents this by rejecting the connection at the cfg80211 layer, avoiding unnecessary retries and potential confusion.

Mitigation

The fix has been backported to stable kernel versions. Users should update their kernels to include the commit. No workaround is mentioned.