CVE-2023-53679

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt7601u: fix an integer underflow

Fix an integer underflow that leads to a null pointer dereference in

'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet

could be manipulated, which could trigger an integer underflow of

'seg_len' in 'mt7601u_rx_process_seg()'. This underflow subsequently

causes the 'bad_frame' checks in 'mt7601u_rx_skb_from_seg()' to be

bypassed, eventually leading to a dereference of the pointer 'p', which

is a null pointer.

Ensure that 'dma_len' is greater than 'min_seg_len'.

Found by a modified version of syzkaller.

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]

CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G W O 5.14.0+

#139

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS

rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014

RIP: 0010:skb_add_rx_frag+0x143/0x370

Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References