CVE-2023-53715

Vulnerability

Overview The brcmfmac WiFi driver in the Linux kernel mishandled PMK (Pairwise Master Key) passing by converting it to hex, which did not work on newer chips like BCM4387. Additionally, the structure was not cleared before setting the PMK, leading to leakage of uninitialized stack contents to the device.

Attack

Surface An attacker with local access or ability to trigger PMK configuration could exploit this information leak. The vulnerability is in the cfg80211 interface, so any user or process that can issue PMK-related commands could potentially trigger the leak.

Impact

The leak of uninitialized stack memory could expose sensitive kernel data to the device, potentially aiding in further exploitation.

Mitigation

The fix modifies the PMK handling to pass the key in binary form and clears the structure before use. This fix is applied in the stable kernel commits [1][2][3].