CVE-2023-53822 (GCVE-0-2023-53822)
Vulnerability from cvelistv5 – Published: 2025-12-09 01:29 – Updated: 2025-12-20 08:51
VLAI?
Title
wifi: ath11k: Ignore frags from uninitialized peer in dp.
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: Ignore frags from uninitialized peer in dp.
When max virtual ap interfaces are configured in all the bands with
ACS and hostapd restart is done every 60s, a crash is observed at
random times.
In this certain scenario, a fragmented packet is received for
self peer, for which rx_tid and rx_frags are not initialized in
datapath. While handling this fragment, crash is observed as the
rx_frag list is uninitialised and when we walk in
ath11k_dp_rx_h_sort_frags, skb null leads to exception.
To address this, before processing received fragments we check
dp_setup_done flag is set to ensure that peer has completed its
dp peer setup for fragment queue, else ignore processing the
fragments.
Call trace:
ath11k_dp_process_rx_err+0x550/0x1084 [ath11k]
ath11k_dp_service_srng+0x70/0x370 [ath11k]
0xffffffc009693a04
__napi_poll+0x30/0xa4
net_rx_action+0x118/0x270
__do_softirq+0x10c/0x244
irq_exit+0x64/0xb4
__handle_domain_irq+0x88/0xac
gic_handle_irq+0x74/0xbc
el1_irq+0xf0/0x1c0
arch_cpu_idle+0x10/0x18
do_idle+0x104/0x248
cpu_startup_entry+0x20/0x64
rest_init+0xd0/0xdc
arch_call_rest_init+0xc/0x14
start_kernel+0x480/0x4b8
Code: f9400281 f94066a2 91405021 b94a0023 (f9406401)
Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
d5c65159f2895379e11ca13f62feabe93278985d , < e78526a06b53718bfc1dfff37864c7760e41f8ec
(git)
Affected: d5c65159f2895379e11ca13f62feabe93278985d , < 41efc47f5bc53e63461579e206adc17c4452ab6e (git) Affected: d5c65159f2895379e11ca13f62feabe93278985d , < a06bfb3c9f69f303692cdae87bc0899d2ae8b2a6 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath11k/dp.c",
"drivers/net/wireless/ath/ath11k/dp_rx.c",
"drivers/net/wireless/ath/ath11k/peer.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e78526a06b53718bfc1dfff37864c7760e41f8ec",
"status": "affected",
"version": "d5c65159f2895379e11ca13f62feabe93278985d",
"versionType": "git"
},
{
"lessThan": "41efc47f5bc53e63461579e206adc17c4452ab6e",
"status": "affected",
"version": "d5c65159f2895379e11ca13f62feabe93278985d",
"versionType": "git"
},
{
"lessThan": "a06bfb3c9f69f303692cdae87bc0899d2ae8b2a6",
"status": "affected",
"version": "d5c65159f2895379e11ca13f62feabe93278985d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath11k/dp.c",
"drivers/net/wireless/ath/ath11k/dp_rx.c",
"drivers/net/wireless/ath/ath11k/peer.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.30",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.4",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: Ignore frags from uninitialized peer in dp.\n\nWhen max virtual ap interfaces are configured in all the bands with\nACS and hostapd restart is done every 60s, a crash is observed at\nrandom times.\nIn this certain scenario, a fragmented packet is received for\nself peer, for which rx_tid and rx_frags are not initialized in\ndatapath. While handling this fragment, crash is observed as the\nrx_frag list is uninitialised and when we walk in\nath11k_dp_rx_h_sort_frags, skb null leads to exception.\n\nTo address this, before processing received fragments we check\ndp_setup_done flag is set to ensure that peer has completed its\ndp peer setup for fragment queue, else ignore processing the\nfragments.\n\nCall trace:\n ath11k_dp_process_rx_err+0x550/0x1084 [ath11k]\n ath11k_dp_service_srng+0x70/0x370 [ath11k]\n 0xffffffc009693a04\n __napi_poll+0x30/0xa4\n net_rx_action+0x118/0x270\n __do_softirq+0x10c/0x244\n irq_exit+0x64/0xb4\n __handle_domain_irq+0x88/0xac\n gic_handle_irq+0x74/0xbc\n el1_irq+0xf0/0x1c0\n arch_cpu_idle+0x10/0x18\n do_idle+0x104/0x248\n cpu_startup_entry+0x20/0x64\n rest_init+0xd0/0xdc\n arch_call_rest_init+0xc/0x14\n start_kernel+0x480/0x4b8\n Code: f9400281 f94066a2 91405021 b94a0023 (f9406401)\n\nTested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1"
}
],
"providerMetadata": {
"dateUpdated": "2025-12-20T08:51:27.266Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e78526a06b53718bfc1dfff37864c7760e41f8ec"
},
{
"url": "https://git.kernel.org/stable/c/41efc47f5bc53e63461579e206adc17c4452ab6e"
},
{
"url": "https://git.kernel.org/stable/c/a06bfb3c9f69f303692cdae87bc0899d2ae8b2a6"
}
],
"title": "wifi: ath11k: Ignore frags from uninitialized peer in dp.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53822",
"datePublished": "2025-12-09T01:29:35.206Z",
"dateReserved": "2025-12-09T01:27:17.824Z",
"dateUpdated": "2025-12-20T08:51:27.266Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-53822\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-09T16:17:20.993\",\"lastModified\":\"2025-12-09T18:37:13.640\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath11k: Ignore frags from uninitialized peer in dp.\\n\\nWhen max virtual ap interfaces are configured in all the bands with\\nACS and hostapd restart is done every 60s, a crash is observed at\\nrandom times.\\nIn this certain scenario, a fragmented packet is received for\\nself peer, for which rx_tid and rx_frags are not initialized in\\ndatapath. While handling this fragment, crash is observed as the\\nrx_frag list is uninitialised and when we walk in\\nath11k_dp_rx_h_sort_frags, skb null leads to exception.\\n\\nTo address this, before processing received fragments we check\\ndp_setup_done flag is set to ensure that peer has completed its\\ndp peer setup for fragment queue, else ignore processing the\\nfragments.\\n\\nCall trace:\\n ath11k_dp_process_rx_err+0x550/0x1084 [ath11k]\\n ath11k_dp_service_srng+0x70/0x370 [ath11k]\\n 0xffffffc009693a04\\n __napi_poll+0x30/0xa4\\n net_rx_action+0x118/0x270\\n __do_softirq+0x10c/0x244\\n irq_exit+0x64/0xb4\\n __handle_domain_irq+0x88/0xac\\n gic_handle_irq+0x74/0xbc\\n el1_irq+0xf0/0x1c0\\n arch_cpu_idle+0x10/0x18\\n do_idle+0x104/0x248\\n cpu_startup_entry+0x20/0x64\\n rest_init+0xd0/0xdc\\n arch_call_rest_init+0xc/0x14\\n start_kernel+0x480/0x4b8\\n Code: f9400281 f94066a2 91405021 b94a0023 (f9406401)\\n\\nTested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/41efc47f5bc53e63461579e206adc17c4452ab6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a06bfb3c9f69f303692cdae87bc0899d2ae8b2a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e78526a06b53718bfc1dfff37864c7760e41f8ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…