246 lines
14 KiB
JSON
246 lines
14 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2025-23133",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2025-01-11T14:28:41.511Z",
|
||
"datePublished": "2025-04-16T14:13:14.485Z",
|
||
"dateUpdated": "2026-10-21T12:36:20.439Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-10-21T12:36:20.439Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: update channel list in reg notifier instead reg worker\n\nCurrently when ath11k gets a new channel list, it will be processed\naccording to the following steps:\n1. update new channel list to cfg80211 and queue reg_work.\n2. cfg80211 handles new channel list during reg_work.\n3. update cfg80211's handled channel list to firmware by\nath11k_reg_update_chan_list().\n\nBut ath11k will immediately execute step 3 after reg_work is just\nqueued. Since step 2 is asynchronous, cfg80211 may not have completed\nhandling the new channel list, which may leading to an out-of-bounds\nwrite error:\nBUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list\nCall Trace:\n ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k]\n kfree+0x109/0x3a0\n ath11k_regd_update+0x1cf/0x350 [ath11k]\n ath11k_regd_update_work+0x14/0x20 [ath11k]\n process_one_work+0xe35/0x14c0\n\nShould ensure step 2 is completely done before executing step 3. Thus\nWen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set,\ncfg80211 will notify ath11k after step 2 is done.\n\nSo enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will\nnotify ath11k after step 2 is done. At this time, there will be no\nKASAN bug during the execution of the step 3.\n\n[1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 8.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:A - The trigger is an 802.11d Country IE in beacons/probe responses harvested by the firmware's periodic 11d offload scan, which drives `WMI_11D_NEW_COUNTRY_EVENTID` → `ath11k_reg_set_cc()` → `WMI_REG_CHAN_LIST_CC_EVENTID` → `ath11k_regd_update_work`. This requires only RF proximity to the victim's Wi-Fi radio, matching the adjacent-network scope for Wi-Fi frame injection.\nAC:L - The attacker initiates both racing workers with a single beaconed country change — `ath11k_regd_update_work` on the ath11k workqueue and cfg80211's `reg_work` on the system workqueue — and the window is widened by the sleeping `kzalloc(GFP_KERNEL)` and per-channel `ath11k_dbg()` calls between the counting and filling loops. Since 11d scans repeat on a fixed interval and the attacker can toggle the advertised country indefinitely, the race can be retried until won.\nPR:N - No credentials, association, or authentication are needed — the firmware's 11d scan ingests Country IEs from unassociated broadcast beacons of any AP in range. No local account on the victim is involved at any point in the path.\nUI:N - A station interface that is simply up and scanning (the normal state for a laptop, phone, or embedded client) runs the 11d scan automatically; no user action such as connecting to the rogue AP is required. The regdomain update and the racing workers are entirely kernel-internal once the beacon is received.\nS:U - The out-of-bounds write corrupts kernel slab memory adjacent to the `scan_chan_list_params` allocation, staying within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - A heap out-of-bounds write of up to ~1–2 KB of `struct channel_param` records overwrites adjacent slab objects, which can be groomed (e.g. onto neighboring length or pointer fields) to yield an information-disclosure primitive. Per kernel scoring guidance, memory corruption that can be leveraged for disclosure rates High.\nI:H - This is a genuine slab out-of-bounds write with attacker-influenced length (via race timing over which bands cfg80211 has re-enabled) and partially attacker-influenced contents (`mhz`, `cfreq1`, `maxpower`, `maxregpower`, `antennamax` derived from the attacker-chosen regdomain). Out-of-bounds writes into adjacent heap objects are a standard route to control-flow hijack and rate High.\nA:H - The bug was found as a KASAN slab-out-of-bounds report followed by heap corruption at `kfree()`, which reliably produces oopses/panics on hardened or SLUB-debug kernels and unpredictable kernel state otherwise. Any such crash of the kernel is a full availability loss."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/net/wireless/ath/ath11k/reg.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "f45cb6b29cd36514e13f7519770873d8c0457008",
|
||
"lessThan": "ec97bd5378c594be1f1c7a15dcf381e075b665d9",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f45cb6b29cd36514e13f7519770873d8c0457008",
|
||
"lessThan": "26618c039b78a76c373d4e02c5fbd52e3a73aead",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f45cb6b29cd36514e13f7519770873d8c0457008",
|
||
"lessThan": "f952fb83c9c6f908d27500764c4aee1df04b9d3f",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f45cb6b29cd36514e13f7519770873d8c0457008",
|
||
"lessThan": "933ab187e679e6fbdeea1835ae39efcc59c022d2",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f96fd36936310cefe0ea1370a9ae30e6746e6f62",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "c97b120950b49d76bdce013bd4d9577d769465f4",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "5.15.79",
|
||
"lessThan": "5.16",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.0.9",
|
||
"lessThan": "6.1",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/net/wireless/ath/ath11k/reg.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "6.1",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "6.1",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6.160",
|
||
"lessThanOrEqual": "6.6.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.12.46",
|
||
"lessThanOrEqual": "6.12.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.14.2",
|
||
"lessThanOrEqual": "6.14.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.15",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.1",
|
||
"versionEndExcluding": "6.6.160"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.1",
|
||
"versionEndExcluding": "6.12.46"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.1",
|
||
"versionEndExcluding": "6.14.2"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.1",
|
||
"versionEndExcluding": "6.15"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.15.79"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.0.9"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/ec97bd5378c594be1f1c7a15dcf381e075b665d9"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/26618c039b78a76c373d4e02c5fbd52e3a73aead"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f952fb83c9c6f908d27500764c4aee1df04b9d3f"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2"
|
||
}
|
||
],
|
||
"title": "wifi: ath11k: update channel list in reg notifier instead reg worker",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2025-23133",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2026-10-15T21:44:40.826018Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-10-15T21:51:58.417Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |