Skip to content

[ciqlts8 6] CVE-2023-53226 #775

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
roxanan1996 merged 3 commits into from
Dec 18, 2025
Merged

[ciqlts8 6] CVE-2023-53226 #775

roxanan1996 merged 3 commits into from
Dec 18, 2025

Conversation

@roxanan1996
Copy link
Contributor

@roxanan1996 roxanan1996 commented Dec 17, 2025

DESCRIPTION

Commit "wifi: mwifiex: Fix OOB and integer underflow when rx packets" is the CVE fix.
The other two are bf.
Commit "wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet" turned out to be a CVE too.

COMMITS

wifi: mwifiex: Fix OOB and integer underflow when rx packets

jira VULN-154521
cve CVE-2023-53226
commit-author Polaris Pi <pinkperfect2021@gmail.com>
commit 11958528161731c58e105b501ed60b83a91ea941

wifi: mwifiex: Fix missed return in oob checks failed path

jira VULN-154521
cve-bf CVE-2023-53226
commit-author Polaris Pi <pinkperfect2021@gmail.com>
commit 2785851c627f2db05f9271f7f63661b5dbd95c4c

wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet

jira VULN-169541
cve CVE-2023-52525
commit-author Pin-yen Lin <treapking@chromium.org>
commit aef7a0300047e7b4707ea0411dc9597cba108fc8

TESTING

BUILD

> grep -E -B 5 -A 5 '\[TIMER\]|^Starting Build' /home/rnicolescu/ciq/kernels/lts-8.6_remediation/kernel-build-after.log
/home/rnicolescu/ciq/kernels/lts-8.6_remediation/kernel-src-tree
Running make mrproper...
[TIMER]{MRPROPER}: 4s
x86_64 architecture detected, copying config
'configs/kernel-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-rnicolescu_ciqlts8_6_remediation-08b697299330e"
Making olddefconfig
--
  HOSTLD  scripts/kconfig/conf
scripts/kconfig/conf  --olddefconfig Kconfig
#
# configuration written to .config
#
Starting Build
scripts/kconfig/conf  --syncconfig Kconfig
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_64_x32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_64.h
--
  LD [M]  sound/usb/usx2y/snd-usb-usx2y.ko
  LD [M]  sound/virtio/virtio_snd.ko
  LD [M]  sound/x86/snd-hdmi-lpe-audio.ko
  LD [M]  sound/xen/snd_xen_front.ko
  LD [M]  virt/lib/irqbypass.ko
[TIMER]{BUILD}: 1407s
Making Modules
  INSTALL arch/x86/crypto/blowfish-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx2.ko
  INSTALL arch/x86/crypto/camellia-x86_64.ko
--
  INSTALL sound/virtio/virtio_snd.ko
  INSTALL sound/x86/snd-hdmi-lpe-audio.ko
  INSTALL sound/xen/snd_xen_front.ko
  INSTALL virt/lib/irqbypass.ko
  DEPMOD  4.18.0-rnicolescu_ciqlts8_6_remediation-08b697299330e+
[TIMER]{MODULES}: 9s
Making Install
sh ./arch/x86/boot/install.sh 4.18.0-rnicolescu_ciqlts8_6_remediation-08b697299330e+ arch/x86/boot/bzImage \
	System.map "/boot"
[TIMER]{INSTALL}: 30s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6_remediation-08b697299330e+ and Index to 0
The default is /boot/loader/entries/0557d5db56ae44d3bc0a308b67af469d-4.18.0-rnicolescu_ciqlts8_6_remediation-08b697299330e+.conf with index 0 and kernel /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6_remediation-08b697299330e+
The default is /boot/loader/entries/0557d5db56ae44d3bc0a308b67af469d-4.18.0-rnicolescu_ciqlts8_6_remediation-08b697299330e+.conf with index 0 and kernel /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6_remediation-08b697299330e+
Generating grub configuration file ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 4s
[TIMER]{BUILD}: 1407s
[TIMER]{MODULES}: 9s
[TIMER]{INSTALL}: 30s
[TIMER]{TOTAL} 1455s
Rebooting in 10 seconds

Kselftests

> /home/rnicolescu/ciq/kernel-tools/kselftest-diff.sh /home/rnicolescu/ciq/kernels/lts-8.6_remediation
/home/rnicolescu/ciq/kernels/lts-8.6_remediation/kselftest-before.log
212
/home/rnicolescu/ciq/kernels/lts-8.6_remediation/kselftest-after.log
212
Before: /home/rnicolescu/ciq/kernels/lts-8.6_remediation/kselftest-before.log
After: /home/rnicolescu/ciq/kernels/lts-8.6_remediation/kselftest-after.log
Diff:
No differences found.

Check_kernel_commits

> python3 /home/rnicolescu/ciq/kernel-src-tree-tools/check_kernel_commits.py --repo /home/rnicolescu/ciq/kernels/lts-8.6_remediation/kernel-src-tree --pr_branch {rnicolescu}_ciqlts8_6_remediation --base_branch origin/ciqlts8_6 --check-cves
All referenced commits exist upstream and have no Fixes: tags.

Run interdiff

> python3 /home/rnicolescu/ciq/kernel-src-tree-tools/run_interdiff.py --repo /home/rnicolescu/ciq/kernels/lts-8.6_remediation/kernel-src-tree --pr_branch {rnicolescu}_ciqlts8_6_remediation --base_branch origin/ciqlts8_6
All backported commits match their upstream counterparts.

Run jira_pr_check

> python3 /home/rnicolescu/ciq/kernel-src-tree-tools/jira_pr_check.py --kernel-src-tree /home/rnicolescu/ciq/kernels/lts-8.6_remediation/kernel-src-tree --merge-target {rnicolescu}_ciqlts8_6_remediation --pr-branch origin/ciqlts8_6

## JIRA PR Check Results

✅ **No issues found!**


---
**Summary:** Checked 0 commit(s) total.

@roxanan1996
wifi: mwifiex: Fix OOB and integer underflow when rx packets
5ad5527 
jira VULN-154521
cve CVE-2023-53226
commit-author Polaris Pi <pinkperfect2021@gmail.com>
commit 1195852

Make sure mwifiex_process_mgmt_packet,
mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet,
mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet
not out-of-bounds access the skb->data buffer.

Fixes: 2dbaf75 ("mwifiex: report received management frames to cfg80211")
	Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com>
	Reviewed-by: Matthew Wang <matthewmwang@chromium.org>
	Reviewed-by: Brian Norris <briannorris@chromium.org>
	Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230723070741.1544662-1-pinkperfect2021@gmail.com
(cherry picked from commit 1195852)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
@roxanan1996
wifi: mwifiex: Fix missed return in oob checks failed path
73e5857 
jira VULN-154521
cve-bf CVE-2023-53226
commit-author Polaris Pi <pinkperfect2021@gmail.com>
commit 2785851

Add missed return in mwifiex_uap_queue_bridged_pkt() and
mwifiex_process_rx_packet().

Fixes: 1195852 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets")
	Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com>
	Reported-by: Dmitry Antipov <dmantipov@yandex.ru>
	Acked-by: Brian Norris <briannorris@chromium.org>
	Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230810083911.3725248-1-pinkperfect2021@gmail.com
(cherry picked from commit 2785851)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
@roxanan1996
wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
08b6972 
jira VULN-169541
cve CVE-2023-52525
commit-author Pin-yen Lin <treapking@chromium.org>
commit aef7a03

Only skip the code path trying to access the rfc1042 headers when the
buffer is too small, so the driver can still process packets without
rfc1042 headers.

Fixes: 1195852 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets")
	Signed-off-by: Pin-yen Lin <treapking@chromium.org>
	Acked-by: Brian Norris <briannorris@chromium.org>
	Reviewed-by: Matthew Wang <matthewmwang@chromium.org>
	Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230908104308.1546501-1-treapking@chromium.org
(cherry picked from commit aef7a03)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
@roxanan1996 roxanan1996 self-assigned this Dec 17, 2025
@roxanan1996 roxanan1996 requested a review from a team December 17, 2025 15:13
bmastbergen
bmastbergen approved these changes Dec 17, 2025
View reviewed changes
Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

PlaidCat
PlaidCat approved these changes Dec 17, 2025
View reviewed changes
Copy link
Collaborator

@PlaidCat PlaidCat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@roxanan1996 roxanan1996 merged commit 4aaae6f into ciqlts8_6 Dec 18, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PlaidCat PlaidCat PlaidCat approved these changes

@bmastbergen bmastbergen bmastbergen approved these changes

Assignees

@roxanan1996 roxanan1996

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@roxanan1996 @PlaidCat @bmastbergen