CVE-2023-53822

Vulnerability

Overview

The issue occurs in the Linux kernel's ath11k Wi-Fi driver, specifically in the datapath (dp) when processing fragmented packets for a self peer that has not yet completed its DP peer setup. The rx_tid and rx_frags structures remain uninitialized during this window, leading to a NULL pointer dereference when the kernel attempts to walk the rx_frag list in ath11k_dp_rx_h_sort_frags [1].

Exploitation

Conditions

An attacker on the same Wi-Fi network can trigger this bug by sending a fragmented packet to the vulnerable device under specific conditions: when maximum virtual AP interfaces are configured across all bands with ACS (Automatic Channel Selection), and hostapd is restarted every 60 seconds [1]. The race condition between peer initialization and reception of a fragmented packet for that peer makes the driver process data from an uninitialized peer's fragment queue.

Impact

Successful exploitation leads to a kernel panic, causing a denial of service (DoS) on the affected device. The crash trace shows the exception occurs within ath11k_dp_process_rx_err while handling the fragmented frame, ultimately crashing the system and disrupting Wi-Fi services [1].

Mitigation

Status

The fix was committed to the Linux kernel stable tree, adding a check for the dp_setup_done flag before processing fragments. If the peer has not completed its fragment queue setup, the driver now ignores the fragments, preventing the crash [1]. Users should apply the latest stable kernel updates containing this commit (a06bfb3c9f69f303692cdae87bc0899d2ae8b2a6).