CVE-2023-53710

CVE-2023-53710 is a vulnerability in the Linux kernel's mt76 Wi-Fi driver for MediaTek MT7921 chipsets. The issue is in the mt7921_acpi_read function: when an ACPI SAR (Specific Absorption Rate) table is present but malformed (e.g., SAR count is zero), the function fails to return a proper error code, causing the caller to proceed with a NULL pointer. This leads to a kernel NULL pointer dereference at address 0x4 when the driver attempts to dereference the invalid pointer during initialization [1].

Exploitation

An attacker needs local access to trigger the vulnerable code path by providing a crafted ACPI table that passes the initial presence check but has invalid contents. No special privileges are required beyond the ability to boot or hotplug a device using the mt7921 driver. The bug manifests as a NULL pointer dereference in mt7921_init_acpi_sar during the probe sequence, as shown by the call trace in the kernel log [1].

Impact

Successful exploitation causes a kernel NULL pointer dereference, resulting in a denial of service (system crash or panic). The impact is limited to local availability; there is no evidence of privilege escalation or data exfiltration.

Mitigation

The fix corrects the return code in mt7921_acpi_read to indicate an invalid ACPI SAR table, preventing the NULL pointer dereference. The patch has been merged into the upstream kernel stable tree [1]. Users are advised to apply the patch or update to a kernel version containing the fix.