Vulnerability-Lookup

CVE-2023-53570 (GCVE-0-2023-53570)

Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2026-08-05 09:14

Title

wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() nl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the number of MBSSID elements in the nested netlink attribute attrs, which can lead to an integer overflow if a user of the nl80211 interface specifies 256 or more elements in the corresponding attribute in userspace. The integer overflow can lead to a heap buffer overflow as num_elems determines the size of the trailing array in elems, and this array is thereafter written to for each element in attrs. Note that this vulnerability only affects devices with the wiphy->mbssid_max_interfaces member set for the wireless physical device struct in the device driver, and can only be triggered by a process with CAP_NET_ADMIN capabilities. Fix this by checking for a maximum of 255 elements in attrs.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/e642eb67b8c10dcce…
https://git.kernel.org/stable/c/7d09f9f255a5f7857…
https://git.kernel.org/stable/c/6311071a056272e1e…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: dc1e3cb8da8b414b37208b2fb6755fef8122504b , < e642eb67b8c10dcce758d549cc81564116e0fa49 (git) Affected: dc1e3cb8da8b414b37208b2fb6755fef8122504b , < 7d09f9f255a5f78578deba5454923072bb53b16c (git) Affected: dc1e3cb8da8b414b37208b2fb6755fef8122504b , < 6311071a056272e1e761de8d0305e87cc566f734 (git)	guessed
Linux	Linux	Affected: 5.16 Unaffected: 0 , < 5.16 (semver) Unaffected: 6.1.46 , ≤ 6.1.* (semver) Unaffected: 6.4.11 , ≤ 6.4.* (semver) Unaffected: 6.5 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/nl80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e642eb67b8c10dcce758d549cc81564116e0fa49",
              "status": "affected",
              "version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
              "versionType": "git"
            },
            {
              "lessThan": "7d09f9f255a5f78578deba5454923072bb53b16c",
              "status": "affected",
              "version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
              "versionType": "git"
            },
            {
              "lessThan": "6311071a056272e1e761de8d0305e87cc566f734",
              "status": "affected",
              "version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/nl80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.46",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.11",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()\n\nnl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the\nnumber of MBSSID elements in the nested netlink attribute attrs, which can\nlead to an integer overflow if a user of the nl80211 interface specifies\n256 or more elements in the corresponding attribute in userspace. The\ninteger overflow can lead to a heap buffer overflow as num_elems determines\nthe size of the trailing array in elems, and this array is thereafter\nwritten to for each element in attrs.\n\nNote that this vulnerability only affects devices with the\nwiphy-\u003embssid_max_interfaces member set for the wireless physical device\nstruct in the device driver, and can only be triggered by a process with\nCAP_NET_ADMIN capabilities.\n\nFix this by checking for a maximum of 255 elements in attrs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by crafting an nl80211 generic-netlink message (NL80211_CMD_START_AP/SET_BEACON/CHANNEL_SWITCH) from local userspace; despite being in the wireless subsystem, no over-the-air frame is involved. Per kernel scoring guidance, netlink-reachable bugs are Local.\nAC:L - The attacker fully and deterministically controls the trigger by placing 256 nested attributes in NL80211_ATTR_MBSSID_ELEMS \u2014 no race, no timing, no memory-layout condition outside their influence, and the overflow size and contents are directly tunable via the attribute count and lengths.\nPR:L - The gate is GENL_UNS_ADMIN_PERM, i.e. netlink_ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), which an unprivileged user obtains via `unshare -Urn`; mac80211_hwsim\u0027s radio-creation command is gated identically and places the new wiphy (with mbssid_max_interfaces = 8) in the caller\u0027s netns, giving a complete unprivileged local path.\nUI:N - The attacker performs every step themselves \u2014 create/select an AP-capable interface and issue the netlink command \u2014 with no action required from any other user or administrator.\nS:U - The heap corruption occurs in kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A 4 KB controlled out-of-bounds heap write lets the attacker overwrite adjacent objects\u0027 pointers and length fields, which is readily leveraged into arbitrary kernel-memory disclosure, so confidentiality impact is High.\nI:H - This is a large, attacker-sized out-of-bounds heap write with a fully attacker-controlled size_t field per entry, providing a strong slab-corruption primitive suitable for control-flow hijack and privilege escalation.\nA:H - Writing 4096 bytes past an 8-byte kmalloc allocation reliably corrupts slab metadata and neighbouring objects, producing kernel oops/panic and complete loss of availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:53.243Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e642eb67b8c10dcce758d549cc81564116e0fa49"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d09f9f255a5f78578deba5454923072bb53b16c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6311071a056272e1e761de8d0305e87cc566f734"
        }
      ],
      "title": "wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53570",
    "datePublished": "2025-10-04T15:17:11.525Z",
    "dateReserved": "2025-10-04T15:14:15.925Z",
    "dateUpdated": "2026-08-05T09:14:53.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53570",
      "date": "2026-09-15",
      "epss": "0.00167",
      "percentile": "0.06262"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53570\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-04T16:15:52.577\",\"lastModified\":\"2026-08-04T10:19:12.740\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()\\n\\nnl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the\\nnumber of MBSSID elements in the nested netlink attribute attrs, which can\\nlead to an integer overflow if a user of the nl80211 interface specifies\\n256 or more elements in the corresponding attribute in userspace. The\\ninteger overflow can lead to a heap buffer overflow as num_elems determines\\nthe size of the trailing array in elems, and this array is thereafter\\nwritten to for each element in attrs.\\n\\nNote that this vulnerability only affects devices with the\\nwiphy-\u003embssid_max_interfaces member set for the wireless physical device\\nstruct in the device driver, and can only be triggered by a process with\\nCAP_NET_ADMIN capabilities.\\n\\nFix this by checking for a maximum of 255 elements in attrs.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/wireless/nl80211.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"dc1e3cb8da8b414b37208b2fb6755fef8122504b\",\"lessThan\":\"e642eb67b8c10dcce758d549cc81564116e0fa49\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc1e3cb8da8b414b37208b2fb6755fef8122504b\",\"lessThan\":\"7d09f9f255a5f78578deba5454923072bb53b16c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc1e3cb8da8b414b37208b2fb6755fef8122504b\",\"lessThan\":\"6311071a056272e1e761de8d0305e87cc566f734\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/wireless/nl80211.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.46\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.11\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.46\",\"matchCriteriaId\":\"D8B8CC90-9492-465C-81D4-10DA3B712286\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.4.11\",\"matchCriteriaId\":\"C36FD9E6-B6D7-4887-8F08-C1F64E139D5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B3E6E4D-E24E-4630-B00C-8C9901C597B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4A01A71-0F09-4DB2-A02F-7EFFBE27C98D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5608371-157A-4318-8A2E-4104C3467EA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2226A776-DF8C-49E0-A030-0A7853BB018A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F15C659-DF06-455A-9765-0E6DE920F29A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6311071a056272e1e761de8d0305e87cc566f734\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d09f9f255a5f78578deba5454923072bb53b16c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e642eb67b8c10dcce758d549cc81564116e0fa49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:18:17+00:00",
      "cve": "CVE-2023-53570",
      "id": "CVE-2023-53570",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "399",
      "product_status:known_affected": "52",
      "product_status:known_not_affected": "104",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53570.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:06:25Z",
      "cve": "CVE-2023-53570",
      "id": "CVE-2023-53570",
      "initial_release_date": "2025-10-05T02:56:08Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "393",
      "product_status:recommended": "359",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53570",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53570.json",
      "version": "43"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2023-53570 (GCVE-0-2023-53570)

Tags

Sightings

Nomenclature