197 lines
12 KiB
JSON
197 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-54071",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-24T12:21:05.093Z",
|
|
"datePublished": "2025-12-24T12:23:14.874Z",
|
|
"dateUpdated": "2026-10-15T21:41:38.954Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T09:16:57.302Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: use work to update rate to avoid RCU warning\n\nThe ieee80211_ops::sta_rc_update must be atomic, because\nieee80211_chan_bw_change() holds rcu_read lock while calling\ndrv_sta_rc_update(), so create a work to do original things.\n\n Voluntary context switch within RCU read-side critical section!\n WARNING: CPU: 0 PID: 4621 at kernel/rcu/tree_plugin.h:318\n rcu_note_context_switch+0x571/0x5d0\n CPU: 0 PID: 4621 Comm: kworker/u16:2 Tainted: G W OE\n Workqueue: phy3 ieee80211_chswitch_work [mac80211]\n RIP: 0010:rcu_note_context_switch+0x571/0x5d0\n Call Trace:\n <TASK>\n __schedule+0xb0/0x1460\n ? __mod_timer+0x116/0x360\n schedule+0x5a/0xc0\n schedule_timeout+0x87/0x150\n ? trace_raw_output_tick_stop+0x60/0x60\n wait_for_completion_timeout+0x7b/0x140\n usb_start_wait_urb+0x82/0x160 [usbcore\n usb_control_msg+0xe3/0x140 [usbcore\n rtw_usb_read+0x88/0xe0 [rtw_usb\n rtw_usb_read8+0xf/0x10 [rtw_usb\n rtw_fw_send_h2c_command+0xa0/0x170 [rtw_core\n rtw_fw_send_ra_info+0xc9/0xf0 [rtw_core\n drv_sta_rc_update+0x7c/0x160 [mac80211\n ieee80211_chan_bw_change+0xfb/0x110 [mac80211\n ieee80211_change_chanctx+0x38/0x130 [mac80211\n ieee80211_vif_use_reserved_switch+0x34e/0x900 [mac80211\n ieee80211_link_use_reserved_context+0x88/0xe0 [mac80211\n ieee80211_chswitch_work+0x95/0x170 [mac80211\n process_one_work+0x201/0x410\n worker_thread+0x4a/0x3b0\n ? process_one_work+0x410/0x410\n kthread+0xe1/0x110\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x1f/0x30\n </TASK>"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 8.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:A - The trigger is an 802.11 frame — a Channel Switch Announcement or a bandwidth change advertised in a beacon/action frame by the AP the station is associated with — processed by `ieee80211_chswitch_work`, so the attacker must be within radio range or operating a rogue AP. Per kernel guidance, WiFi frame injection is Adjacent.\nAC:L - Every bandwidth-changing channel switch deterministically drives the sleeping USB control transfer into mac80211's RCU read-side critical section, and the attacker can repeat it at will by re-advertising CSA/bandwidth changes. The UAF variant's second side is equally attacker-controlled — a spoofed deauth forces the concurrent `sta_info` teardown — so both halves of the race are attacker-driven.\nPR:N - No credentials on the victim system are needed; beacon CSA elements are unprotected even under MFP, and an attacker-operated or spoofed AP reaches the path without any authentication to the target host.\nUI:N - A station that is merely associated or scanning processes the beacon/CSA automatically; no victim action such as opening a file or mounting a filesystem is required.\nS:U - The atomicity violation, RCU stall, and resulting memory corruption are all confined to the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Sleeping inside `rcu_read_lock()` breaks the RCU guarantee on non-preemptible kernels, allowing the grace period to elapse and `sta_info` objects on `local->sta_list` to be freed while the loop still dereferences them — a use-after-free read that per kernel guidance is scored High.\nI:H - The same traversal writes through the potentially freed pointer (`link_sta->pub->bandwidth = new_sta_bw`), giving a UAF write primitive, and the missing `rtwdev->mutex` lets unserialized H2C mailbox/register writes race and corrupt firmware command state.\nA:H - The path produces a kernel WARNING (fatal under `panic_on_warn`) plus \"scheduling while atomic\" on non-preemptible builds, stalls RCU grace periods for seconds per station causing RCU CPU stall warnings and callback backlog, and can crash outright via the use-after-free."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/wireless/realtek/rtw88/mac80211.c",
|
|
"drivers/net/wireless/realtek/rtw88/main.c",
|
|
"drivers/net/wireless/realtek/rtw88/main.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6",
|
|
"lessThan": "107677a8f43521e33e4a653e50fdf55ba622a4ce",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6",
|
|
"lessThan": "dd3af22323e79a2ffabed366db20aab83716fe6f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c1edc86472fc3a5aa3b5c5c53c4e20f6a24992a6",
|
|
"lessThan": "bcafcb959a57a6890e900199690c5fc47da1a304",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/wireless/realtek/rtw88/mac80211.c",
|
|
"drivers/net/wireless/realtek/rtw88/main.c",
|
|
"drivers/net/wireless/realtek/rtw88/main.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.19",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.19",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.30",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3.4",
|
|
"lessThanOrEqual": "6.3.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.4",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.1.30"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.3.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.4"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/107677a8f43521e33e4a653e50fdf55ba622a4ce"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/dd3af22323e79a2ffabed366db20aab83716fe6f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/bcafcb959a57a6890e900199690c5fc47da1a304"
|
|
}
|
|
],
|
|
"title": "wifi: rtw88: use work to update rate to avoid RCU warning",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2023-54071",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-15T21:38:13.834973Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-15T21:41:38.954Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |