CVE-2023-54286

Vulnerability

In the Linux kernel's iwlwifi driver for Intel wireless devices, the iwl_keyinfo.key field is only 16 bytes, but a received TKIP key may be up to 32 bytes because it can contain MIC (Message Integrity Code) keys for RX and TX. During processing in iwlagn_send_sta_key, the full key is copied via memcpy without size checking, causing a field-spanning write overflow [1].

Exploitation

The overflow is triggered when a TKIP key is set via the mac80211 subsystem's key management functions. The attacker would need the ability to supply a crafted TKIP key, such as through a malicious access point or by having local privileges to configure keys. No authentication is required beyond that needed to interact with the wireless interface.

Impact

A field-spanning write leads to a kernel warning (as shown in the backtrace) and can corrupt adjacent memory, potentially causing a system crash or denial of service. The bug does not appear to allow arbitrary code execution, but it degrades system stability.

Mitigation

The fix adds a bounds check to copy no more than the size of the key field, preventing the overflow. Patches have been applied to the stable kernel tree [1]. Users should update to a kernel version containing the fix.