CVE-2023-53589

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: don't trust firmware n_channels

If the firmware sends us a corrupted MCC response with n_channels much larger than the command response can be, we might copy far too much (uninitialized) memory and even crash if the n_channels is large enough to make it run out of the one page allocated for the FW response.

Fix that by checking the lengths. Doing a < comparison would be sufficient, but the firmware should be doing it correctly, so check more strictly.

The iwlwifi MVM driver trusted the firmware-reported n_channels in the MCC response and could memcpy past the actual response buffer, leading to out-of-bounds reads and a potential kernel crash. Exploitation requires a malicious or corrupted NIC firmware (physical/firmware threat model) and not ordinary network input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.