CVE-2023-54286 wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the...

CVE-2023-54286 wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the...

CVE-2022-50881

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix use-after-free in ath9khifusbdisconnect This patch fixes a use-after-free in ath9k that occurs in ath9khifusbdisconnect when ath9kdestroywmi is trying to access 'drvpriv' that has already been freed by...

CVE-2022-50881

CVE-2022-50881 concerns the Linux kernel’s wifi driver ath9k (ath9k_htc) and describes a use-after-free in ath9k_destroy_wmi() triggered during usb disconnect handling. The root cause is access to drv_priv after ieee80211_free_hw() frees hardware in ath9k_htc_hw_deinit(), leading to a use-after-f...

CVE-2022-50880

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: add peer map clean up for peer delete in ath10kstastate When peer delete failed in a disconnect operation, use-after-free detected by KFENCE in below log. It is because for each vdevid and address, it has only one...

CVE-2022-50880

CVE-2022-50880 affects the Linux kernel wifi driver ath10k. The issue arises when a peer deletion fails during disconnect, enabling a use-after-free detected by KFENCE. It occurs because for each vdev_id/address there is a single ath10k_peer, but when firmware reports multiple HTT_T2H_MSG_TYPE_PE...

CVE-2022-50880 wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: add peer map clean up for peer delete in ath10kstastate When peer delete failed in a disconnect operation, use-after-free detected by KFENCE in below log. It is because for each vdevid and address, it has only one...

CVE-2023-54275 wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix memory leak in ath11kpeerrxfragsetup cryptoallocshash allocates resources, which should be released by cryptofreeshash. When ath11kpeerfind fails, there has memory leak. Add missing cryptofreeshash to fix this...

CVE-2023-54275

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix memory leak in ath11kpeerrxfragsetup cryptoallocshash allocates resources, which should be released by cryptofreeshash. When ath11kpeerfind fails, there has memory leak. Add missing cryptofreeshash to fix this...

CVE-2023-54275 wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix memory leak in ath11kpeerrxfragsetup cryptoallocshash allocates resources, which should be released by cryptofreeshash. When ath11kpeerfind fails, there has memory leak. Add missing cryptofreeshash to fix this...

CVE-2023-54275

In the Linux kernel, the wifi driver ath11k has a memory leak in ath11k_peer_rx_frag_setup where crypto_alloc_shash() resources were not released if ath11k_peer_find() failed. The fix releases resources via crypto_free_shash(), addressing the leak. This CVE entry documents the root cause and the ...

CVE-2022-50784

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: fix potential NULL-ptr deref after clone If cloning the SKB fails, don't try to use it, but rather return as if we should pass it. Coverity CID: 1503456...

CVE-2022-50871

The CVE-2022-50871 entries describe a Linux kernel issue in the ath11k wifi driver where qmi_msg_handler initialization could fail to terminate properly. The root cause is that a handler for a message ID might be absent in the handlers array, risking an infinite loop during handler search and res...

CVE-2022-50871

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix qmimsghandler data structure initialization qmimsghandler is required to be null terminated by QMI module. There might be a case where a handler for a msg id is not present in the handlers array which can lead t...

CVE-2022-50871 wifi: ath11k: Fix qmi_msg_handler data structure initialization

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix qmimsghandler data structure initialization qmimsghandler is required to be null terminated by QMI module. There might be a case where a handler for a msg id is not present in the handlers array which can lead t...

CVE-2022-50863

CVE-2022-50863 concerns the Linux kernel wifi driver for the rtw89 stack. The issue, now resolved, is described as freeing an unused skb to prevent a memory leak under power-saving mode. The underlying root cause is the driver not freeing certain skbs, which could lead to a memory leak in affecte...

CVE-2022-50863 wifi: rtw89: free unused skb to prevent memory leak

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: free unused skb to prevent memory leak This avoid potential memory leak under power saving mode...

CVE-2022-50852

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix use after free in mt7921acpiread Don't dereference "sarroot" after it has been freed...

CVE-2022-50852 wifi: mt76: mt7921: fix use after free in mt7921_acpi_read()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix use after free in mt7921acpiread Don't dereference "sarroot" after it has been freed...

CVE-2022-50852

The CVE-2022-50852 entry concerns the Linux kernel WiFi driver for mt76/mt7921. A use-after-free in mt7921_acpi_read() could occur by dereferencing sar_root after it has been freed. The connected documents confirm the vulnerability was resolved in the kernel code path described as: "wifi: mt76: m...