CVE-2023-53717

Vulnerability

A stack-out-of-bounds write vulnerability exists in the ath9k_wmi_rsp_callback() function of the Linux kernel's ath9k WiFi driver. When a WMI command times out in ath9k_wmi_cmd(), the callback may still execute and write to wmi->cmd_rsp_buf, a stack-allocated buffer that is no longer valid after the timeout. This can lead to memory corruption and potential exploitation [1][2].

Exploitation

An attacker with local access to the system can trigger this vulnerability by sending crafted WMI commands to the ath9k device, possibly via USB or network interactions. The bug is a race condition where a timeout occurs before the callback completes, causing the callback to write to freed stack memory. No special privileges are required beyond the ability to interact with the device [3].

Impact

Successful exploitation could result in a denial of service (system crash) or, in more severe cases, privilege escalation due to corruption of kernel memory. The issue was discovered using a modified version of the syzkaller fuzzer [4].

Mitigation

The fix has been applied to the Linux kernel stable branches. The patch sets wmi->last_seq_id to 0 when a timeout occurs, preventing the callback from writing to the stale buffer. Users should update to the latest kernel version that includes this commit [1][2][3][4].