CVE-2023-53717
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9k_wmi_cmd(). The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that could no longer be valid when a timeout occurs. Set wmi->last_seq_id to 0 when a timeout occurred. Found by a modified version of syzkaller. BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx Write of size 4 Call Trace: memcpy ath9k_wmi_ctrl_rx ath9k_htc_rx_msg ath9k_hif_usb_reg_in_cb __usb_hcd_giveback_urb usb_hcd_giveback_urb dummy_timer call_timer_fn run_timer_softirq __do_softirq irq_exit_rcu sysvec_apic_timer_interrupt
Severity
Not scored
CVSS score
Not available
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-22 14:15:46.367000
Last modified
2026-10-28 19:10:00.193000
View original CVE JSON
{
"id": "CVE-2023-53717",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-22T14:15:46.367",
"lastModified": "2026-10-28T19:10:00.193",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()\n\nFix a stack-out-of-bounds write that occurs in a WMI response callback\nfunction that is called after a timeout occurs in ath9k_wmi_cmd().\nThe callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that\ncould no longer be valid when a timeout occurs. Set wmi->last_seq_id to\n0 when a timeout occurred.\n\nFound by a modified version of syzkaller.\n\nBUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx\nWrite of size 4\nCall Trace:\n memcpy\n ath9k_wmi_ctrl_rx\n ath9k_htc_rx_msg\n ath9k_hif_usb_reg_in_cb\n __usb_hcd_giveback_urb\n usb_hcd_giveback_urb\n dummy_timer\n call_timer_fn\n run_timer_softirq\n __do_softirq\n irq_exit_rcu\n sysvec_apic_timer_interrupt"
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: ath9k: Corrige una posible escritura fuera de límites de la pila en ath9k_wmi_rsp_callback()\n\nCorrige una escritura fuera de límites de la pila que ocurre en una función de callback de respuesta WMI que se llama después de que ocurre un tiempo de espera en ath9k_wmi_cmd(). El callback escribe en wmi -> cmd_rsp_buf, un búfer asignado en la pila que ya no podría ser válido cuando ocurre un tiempo de espera. Establece wmi -> last_seq_id en 0 cuando ocurrió un tiempo de espera.\n\nEncontrado por una versión modificada de syzkaller.\n\nBUG: KASAN: fuera de límites de la pila en ath9k_wmi_ctrl_rx\nEscritura de tamaño 4\nTraza de Llamada:\n memcpy\n ath9k_wmi_ctrl_rx\n ath9k_htc_rx_msg\n ath9k_hif_usb_reg_in_cb\n __usb_hcd_giveback_urb\n usb_hcd_giveback_urb\n dummy_timer\n call_timer_fn\n run_timer_softirq\n __do_softirq\n irq_exit_rcu\n sysvec_apic_timer_interrupt"
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/wireless/ath/ath9k/wmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"lessThan": "89a33c3c847b19b19205cde1d924df2a6c70d8eb",
"versionType": "git",
"status": "affected"
},
{
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"lessThan": "ae4933b4f17de8e2b7ff6f91b17d3b0099a6d6bc",
"versionType": "git",
"status": "affected"
},
{
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"lessThan": "bf6dc175a2b53098a69db1236d9d53982f4b1bc0",
"versionType": "git",
"status": "affected"
},
{
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"lessThan": "78b56b0a613a87b61290b95be497fdfe2fe58aa6",
"versionType": "git",
"status": "affected"
},
{
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"lessThan": "1af7eacfad45149c54893a8a9df9e92ef89f0a90",
"versionType": "git",
"status": "affected"
},
{
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"lessThan": "8f28513d9520184059530c01a9f928a1b3809d3f",
"versionType": "git",
"status": "affected"
},
{
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"lessThan": "554048a72d7ecfdd58cc1bfb56e0a1864e64e82c",
"versionType": "git",
"status": "affected"
},
{
"version": "fb9987d0f748c983bb795a86f47522313f701a08",
"lessThan": "8a2f35b9830692f7a616f2f627f943bc748af13a",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/wireless/ath/ath9k/wmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.35",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.35",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "4.14.308",
"lessThanOrEqual": "4.14.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "4.19.276",
"lessThanOrEqual": "4.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.235",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.173",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.99",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.16",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.2.3",
"lessThanOrEqual": "6.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1af7eacfad45149c54893a8a9df9e92ef89f0a90",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/554048a72d7ecfdd58cc1bfb56e0a1864e64e82c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/78b56b0a613a87b61290b95be497fdfe2fe58aa6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/89a33c3c847b19b19205cde1d924df2a6c70d8eb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8a2f35b9830692f7a616f2f627f943bc748af13a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f28513d9520184059530c01a9f928a1b3809d3f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ae4933b4f17de8e2b7ff6f91b17d3b0099a6d6bc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bf6dc175a2b53098a69db1236d9d53982f4b1bc0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}