CVE-2023-53153

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: Fix use after free for wext

Key information in wext.connect is not reset on (re)connect and can hold data from a previous connection.

Reset key data to avoid that drivers or mac80211 incorrectly detect a WEP connection request and access the freed or already reused memory.

Additionally optimize cfg80211_sme_connect() and avoid an useless schedule of conn_work.

The issue is a local use-after-free in cfg80211’s legacy Wireless Extensions path: stale key fields in wext.connect could lead mac80211/drivers to access freed memory. Exploitation is not remote: it requires local interface management privileges (CAP_NET_ADMIN) and the system actually using wext. Practical impact is limited to a possible kernel crash (DoS). Systems using nl80211/cfg80211 instead of wext are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.