cve/published/2023/CVE-2023-52594.mbox

From bippy-1.2.0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@kernel.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2023-52594: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()

Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug
occurs when txs->cnt, data from a URB provided by a USB device, is
bigger than the size of the array txs->txstatus, which is
HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug
handling code after the check. Make the function return if that is the
case.

Found by a modified version of syzkaller.

UBSAN: array-index-out-of-bounds in htc_drv_txrx.c
index 13 is out of range for type '__wmi_event_txstatus [12]'
Call Trace:
 ath9k_htc_txstatus
 ath9k_wmi_event_tasklet
 tasklet_action_common
 __do_softirq
 irq_exit_rxu
 sysvec_apic_timer_interrupt

The Linux kernel CVE team has assigned CVE-2023-52594 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.0 with commit 27876a29de221186c9d5883e5fe5f6da18ef9a45 and fixed in 4.19.307 with commit f44f073c78112ff921a220d01b86d09f2ace59bc
	Issue introduced in 3.0 with commit 27876a29de221186c9d5883e5fe5f6da18ef9a45 and fixed in 5.4.269 with commit f11f0fd1ad6c11ae7856d4325fe9d05059767225
	Issue introduced in 3.0 with commit 27876a29de221186c9d5883e5fe5f6da18ef9a45 and fixed in 5.10.210 with commit 84770a996ad8d7f121ff2fb5a8d149aad52d64c1
	Issue introduced in 3.0 with commit 27876a29de221186c9d5883e5fe5f6da18ef9a45 and fixed in 5.15.149 with commit 9003fa9a0198ce004b30738766c67eb7373479c9
	Issue introduced in 3.0 with commit 27876a29de221186c9d5883e5fe5f6da18ef9a45 and fixed in 6.1.77 with commit 25c6f49ef59b7a9b80a3f7ab9e95268a1b01a234
	Issue introduced in 3.0 with commit 27876a29de221186c9d5883e5fe5f6da18ef9a45 and fixed in 6.6.16 with commit e4f4bac7d3b64eb75f70cd3345712de6f68a215d
	Issue introduced in 3.0 with commit 27876a29de221186c9d5883e5fe5f6da18ef9a45 and fixed in 6.7.4 with commit be609c7002dd4504b15b069cb7582f4c778548d1
	Issue introduced in 3.0 with commit 27876a29de221186c9d5883e5fe5f6da18ef9a45 and fixed in 6.8 with commit 2adc886244dff60f948497b59affb6c6ebb3c348

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52594
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/ath/ath9k/htc_drv_txrx.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f44f073c78112ff921a220d01b86d09f2ace59bc
	https://git.kernel.org/stable/c/f11f0fd1ad6c11ae7856d4325fe9d05059767225
	https://git.kernel.org/stable/c/84770a996ad8d7f121ff2fb5a8d149aad52d64c1
	https://git.kernel.org/stable/c/9003fa9a0198ce004b30738766c67eb7373479c9
	https://git.kernel.org/stable/c/25c6f49ef59b7a9b80a3f7ab9e95268a1b01a234
	https://git.kernel.org/stable/c/e4f4bac7d3b64eb75f70cd3345712de6f68a215d
	https://git.kernel.org/stable/c/be609c7002dd4504b15b069cb7582f4c778548d1
	https://git.kernel.org/stable/c/2adc886244dff60f948497b59affb6c6ebb3c348