{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54286", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-30T12:06:44.526Z", "datePublished": "2025-12-30T12:23:26.421Z", "dateUpdated": "2026-08-05T09:18:59.341Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:18:59.341Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace\n\nA received TKIP key may be up to 32 bytes because it may contain\nMIC rx/tx keys too. These are not used by iwl and copying these\nover overflows the iwl_keyinfo.key field.\n\nAdd a check to not copy more data to iwl_keyinfo.key then will fit.\n\nThis fixes backtraces like this one:\n\n memcpy: detected field-spanning write (size 32) of single field \"sta_cmd.key.key\" at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (size 16)\n WARNING: CPU: 1 PID: 946 at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm]\n \n Hardware name: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017\n RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm]\n \n Call Trace:\n \n iwl_set_dynamic_key+0x1f0/0x220 [iwldvm]\n iwlagn_mac_set_key+0x1e4/0x280 [iwldvm]\n drv_set_key+0xa4/0x1b0 [mac80211]\n ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211]\n ieee80211_key_replace+0x22d/0x8e0 [mac80211]\n " } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "baseScore": 7.6, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The vulnerable path is the 802.11 key-installation path of the iwlwifi dvm WiFi driver, reached when a TKIP key is programmed after association/4-way handshake with a wireless peer on the same WiFi segment. iwldvm supports AP, IBSS/RSN and STATION modes, so an adjacent wireless peer (rogue AP or associating station) drives whether the 32-byte TKIP cipher path is taken, making this Adjacent rather than Local.\nAC:L - The overflow is fully deterministic — mac80211 always passes keylen 32 for WLAN_CIPHER_SUITE_TKIP into a 16-byte field, so every TKIP key install triggers it with no race, timing window, or memory-layout dependency. TKIP is a standard supported cipher and CONFIG_FORTIFY_SOURCE is enabled by default in mainstream distro and Android kernels.\nPR:N - In AP/IBSS mode the key install is performed automatically by hostapd on behalf of an associating adjacent station, and in STA mode by wpa_supplicant when a TKIP-advertising AP is joined; in neither case does the attacker hold any privilege or account on the vulnerable host. Being a WLAN participant is not a privilege level on the target system.\nUI:N - When the affected host runs an AP or IBSS/RSN network with TKIP, an adjacent peer's association alone causes the per-station TKIP key to be programmed and the overflow to execute, with no action by any local user. No file must be opened, filesystem mounted, or connection manually initiated.\nS:U - The over-write stays within the on-stack struct iwl_addsta_cmd owned by the driver and the resulting fault or firmware command corruption is confined to the kernel's own security authority. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:L - There is no out-of-bounds read and no arbitrary memory disclosure, but the FORTIFY WARN backtrace exposes kernel text addresses, register state, and stack contents to the kernel log, and secret TKIP MIC key material is written into the tx_secur_seq_cnt field handed to device firmware, with a plausible TKIP TSC/IV-reuse path against link traffic. This is a limited, bounded exposure rather than arbitrary read.\nI:L - The write is a bounded 16-byte field-spanning overflow that provably cannot escape the 92-byte enclosing struct (fortify's p_size check confirms no struct-level overflow), so no return address, stack canary, or adjacent heap object can be corrupted and the content is not attacker-controlled. It does, however, corrupt the tx_secur_seq_cnt and hw_tkip_mic_rx_key fields programmed into the device, altering the link's TKIP sequence-counter state — a limited modification.\nA:H - The field-spanning write triggers a FORTIFY_SOURCE WARNING with full backtrace, which is an immediate kernel panic on the many hardened, Android, cloud, and CI kernels that set panic_on_warn=1. Additionally, the bogus TKIP TX sequence counter pushed to firmware can break the wireless link through peer replay-detection drops." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/dvm/sta.c" ], "versions": [ { "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5", "lessThan": "76b5ea43ad2fb4f726ddfaff839430a706e7d7c2", "status": "affected", "versionType": "git" }, { "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5", "lessThan": "3ed3c1c2fc3482b72e755820261779cd2e2c5a3e", "status": "affected", "versionType": "git" }, { "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5", "lessThan": "fa57021262e998e2229d6383b1081638df2fe238", "status": "affected", "versionType": "git" }, { "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5", "lessThan": "91ad1ab3cc7e981cb6d6ee100686baed64e1277e", "status": "affected", "versionType": "git" }, { "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5", "lessThan": "87940e4030e4705e1f3fd2bbb1854eae8308314b", "status": "affected", "versionType": "git" }, { "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5", "lessThan": "57189c885149825be8eb8c3524b5af017fdeb941", "status": "affected", "versionType": "git" }, { "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5", "lessThan": "6cd644f66b43709816561d63e0173cb0c7aab159", "status": "affected", "versionType": "git" }, { "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5", "lessThan": "ef16799640865f937719f0771c93be5dca18adc6", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/dvm/sta.c" ], "versions": [ { "version": "3.1", "status": "affected" }, { "version": "0", "lessThan": "3.1", "status": "unaffected", "versionType": "semver" }, { "version": "4.14.316", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.284", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.244", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.181", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.113", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.30", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.4", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "4.14.316" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "4.19.284" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.4.244" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.10.181" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.15.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.1.30" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.3.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/76b5ea43ad2fb4f726ddfaff839430a706e7d7c2" }, { "url": "https://git.kernel.org/stable/c/3ed3c1c2fc3482b72e755820261779cd2e2c5a3e" }, { "url": "https://git.kernel.org/stable/c/fa57021262e998e2229d6383b1081638df2fe238" }, { "url": "https://git.kernel.org/stable/c/91ad1ab3cc7e981cb6d6ee100686baed64e1277e" }, { "url": "https://git.kernel.org/stable/c/87940e4030e4705e1f3fd2bbb1854eae8308314b" }, { "url": "https://git.kernel.org/stable/c/57189c885149825be8eb8c3524b5af017fdeb941" }, { "url": "https://git.kernel.org/stable/c/6cd644f66b43709816561d63e0173cb0c7aab159" }, { "url": "https://git.kernel.org/stable/c/ef16799640865f937719f0771c93be5dca18adc6" } ], "title": "wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace", "x_generator": { "engine": "bippy-1.2.0" } } } }