GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53589 (GCVE-0-2023-53589)

Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2026-08-05 09:14
VLAI
Title
wifi: iwlwifi: mvm: don't trust firmware n_channels
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't trust firmware n_channels If the firmware sends us a corrupted MCC response with n_channels much larger than the command response can be, we might copy far too much (uninitialized) memory and even crash if the n_channels is large enough to make it run out of the one page allocated for the FW response. Fix that by checking the lengths. Doing a < comparison would be sufficient, but the firmware should be doing it correctly, so check more strictly.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < e519a404a5bbba37693cb10fa61794a5fce4fd9b (git)
Affected: dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < d0d39bed9e95f27a246be91c5929254ac043ed30 (git)
Affected: dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < 05ad5a4d421ce65652fcb24d46b7e273130240d6 (git)
Affected: dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < 557ba100d8cf3661ff8d71c0b4a2cba8db555ec2 (git)
Affected: dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < c176f03350954b795322de0bfe1d7b514db41f45 (git)
Affected: dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < 682b6dc29d98e857e6ca4bbc077c7dc2899b7473 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.1
Unaffected: 0 , < 4.1 (semver)
Unaffected: 5.4.244 , ≤ 5.4.* (semver)
Unaffected: 5.10.181 , ≤ 5.10.* (semver)
Unaffected: 5.15.113 , ≤ 5.15.* (semver)
Unaffected: 6.1.30 , ≤ 6.1.* (semver)
Unaffected: 6.3.4 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/nvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e519a404a5bbba37693cb10fa61794a5fce4fd9b",
              "status": "affected",
              "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
              "versionType": "git"
            },
            {
              "lessThan": "d0d39bed9e95f27a246be91c5929254ac043ed30",
              "status": "affected",
              "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
              "versionType": "git"
            },
            {
              "lessThan": "05ad5a4d421ce65652fcb24d46b7e273130240d6",
              "status": "affected",
              "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
              "versionType": "git"
            },
            {
              "lessThan": "557ba100d8cf3661ff8d71c0b4a2cba8db555ec2",
              "status": "affected",
              "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
              "versionType": "git"
            },
            {
              "lessThan": "c176f03350954b795322de0bfe1d7b514db41f45",
              "status": "affected",
              "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
              "versionType": "git"
            },
            {
              "lessThan": "682b6dc29d98e857e6ca4bbc077c7dc2899b7473",
              "status": "affected",
              "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/nvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.244",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.244",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.181",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: don\u0027t trust firmware n_channels\n\nIf the firmware sends us a corrupted MCC response with\nn_channels much larger than the command response can be,\nwe might copy far too much (uninitialized) memory and\neven crash if the n_channels is large enough to make it\nrun out of the one page allocated for the FW response.\n\nFix that by checking the lengths. Doing a \u003c comparison\nwould be sufficient, but the firmware should be doing\nit correctly, so check more strictly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable MCC update path is driven over the air \u2014 the firmware derives the MCC from 802.11d country IEs in received beacons and notifies the driver via MCC_CHUB_UPDATE_CMD, so an attacker within WiFi range selects the input that drives this code and, in the firmware-compromise case (a real over-the-air class for WiFi NICs), controls the malformed response itself. This matches the adjacent scoring used for equivalent unvalidated-WiFi-firmware-event bugs such as the brcmfmac IF event validation CVE.\nAC:L - Triggering is fully deterministic \u2014 a single n_channels field inconsistent with the packet length is enough, with no race to win, no memory-layout grooming, and no victim state dependency. The path executes automatically on every regulatory/MCC update.\nPR:N - No credentials or association are required; iwl_mvm_rx_chub_update_mcc() explicitly bails out when the interface is associated, so the vulnerable path runs precisely in the unauthenticated, pre-association state, and also runs unconditionally during driver init.\nUI:N - Regulatory/MCC updates are processed automatically on beacon reception and at interface bring-up with no user action whatsoever.\nS:U - The out-of-bounds read and write both occur in kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - n_channels is unbounded, so the copy reads arbitrarily far past the one-page FW response buffer into adjacent kernel memory, and the copied uninitialized data is turned into regulatory rules that any unprivileged user can read back via NL80211_CMD_GET_REG.\nI:H - resp_len is an int while n_channels * sizeof(__le32) is size_t, so n_channels around 0x40000000 truncates the allocation to a few bytes while the subsequent memcpy() length stays at ~4 GB, producing a heap out-of-bounds write that destroys large amounts of kernel memory.\nA:H - The oversized copy runs off the allocated RX page and the undersized destination buffer, causing a guaranteed kernel oops/panic \u2014 exactly the crash the commit message describes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:59.706Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e519a404a5bbba37693cb10fa61794a5fce4fd9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0d39bed9e95f27a246be91c5929254ac043ed30"
        },
        {
          "url": "https://git.kernel.org/stable/c/05ad5a4d421ce65652fcb24d46b7e273130240d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/557ba100d8cf3661ff8d71c0b4a2cba8db555ec2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c176f03350954b795322de0bfe1d7b514db41f45"
        },
        {
          "url": "https://git.kernel.org/stable/c/682b6dc29d98e857e6ca4bbc077c7dc2899b7473"
        }
      ],
      "title": "wifi: iwlwifi: mvm: don\u0027t trust firmware n_channels",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53589",
    "datePublished": "2025-10-04T15:44:04.047Z",
    "dateReserved": "2025-10-04T15:40:38.478Z",
    "dateUpdated": "2026-08-05T09:14:59.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53589",
      "date": "2026-09-19",
      "epss": "0.00233",
      "percentile": "0.1448"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/intel/iwlwifi/mvm/nvm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e519a404a5bbba37693cb10fa61794a5fce4fd9b",
                    "status": "affected",
                    "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d0d39bed9e95f27a246be91c5929254ac043ed30",
                    "status": "affected",
                    "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "05ad5a4d421ce65652fcb24d46b7e273130240d6",
                    "status": "affected",
                    "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "557ba100d8cf3661ff8d71c0b4a2cba8db555ec2",
                    "status": "affected",
                    "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c176f03350954b795322de0bfe1d7b514db41f45",
                    "status": "affected",
                    "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "682b6dc29d98e857e6ca4bbc077c7dc2899b7473",
                    "status": "affected",
                    "version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/intel/iwlwifi/mvm/nvm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.1"
                  },
                  {
                    "lessThan": "4.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.244",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.181",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.30",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BFF06705-5499-49B1-BD71-A9059267903F",
                    "versionEndExcluding": "5.4.244",
                    "versionStartIncluding": "4.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F5B1726B-45AA-47F2-9261-6DC963E92248",
                    "versionEndExcluding": "5.10.181",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F3D5E1B5-AB9D-4ECC-8F11-F3E1BF761E27",
                    "versionEndExcluding": "5.15.113",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E9430E62-03EA-42E6-9E5E-BD1D5124D107",
                    "versionEndExcluding": "6.1.30",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26C54BF0-3EED-46D4-92A7-5F07F658B49B",
                    "versionEndExcluding": "6.3.4",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "38BC6744-7D25-4C02-9966-B224CD071D30",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "76061B41-CAE9-4467-BEDE-0FFC7956F2A1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: don\u0027t trust firmware n_channels\n\nIf the firmware sends us a corrupted MCC response with\nn_channels much larger than the command response can be,\nwe might copy far too much (uninitialized) memory and\neven crash if the n_channels is large enough to make it\nrun out of the one page allocated for the FW response.\n\nFix that by checking the lengths. Doing a \u003c comparison\nwould be sufficient, but the firmware should be doing\nit correctly, so check more strictly."
          }
        ],
        "id": "CVE-2023-53589",
        "lastModified": "2026-08-04T10:19:13.570",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-10-04T16:15:55.313",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/05ad5a4d421ce65652fcb24d46b7e273130240d6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/557ba100d8cf3661ff8d71c0b4a2cba8db555ec2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/682b6dc29d98e857e6ca4bbc077c7dc2899b7473"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c176f03350954b795322de0bfe1d7b514db41f45"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d0d39bed9e95f27a246be91c5929254ac043ed30"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e519a404a5bbba37693cb10fa61794a5fce4fd9b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:18:25+00:00",
      "cve": "CVE-2023-53589",
      "id": "CVE-2023-53589",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: iwlwifi: mvm: don\u0027t trust firmware n_channels",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53589.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:06:15Z",
      "cve": "CVE-2023-53589",
      "id": "CVE-2023-53589",
      "initial_release_date": "2025-10-05T02:55:51Z",
      "product_status:known_affected": "544",
      "product_status:known_not_affected": "145",
      "product_status:recommended": "233",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53589",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53589.json",
      "version": "25"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.