CVE-2023-53679

A flaw was found in the Linux kernel's mt7601u wireless driver. An attacker can supply manipulated packet lengths within USB Request Block (URB) data to trigger an integer underflow, bypassing frame validation checks. This issue results in a null-pointer dereference during packet reception, causing a system crash and leading to a Denial of Service (DoS).

A flaw of moderate severity was found in the mt7601u USB wireless driver in the Linux kernel as shipped in Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9 (kernel and kernel-rt). When processing received USB Request Block (URB) data, the driver fails to ensure that the dma_len field is greater than the minimum segment length; a manipulated dma_len value causes an integer underflow of seg_len in mt7601u_rx_process_seg(), which bypasses the bad_frame validation in mt7601u_rx_skb_from_seg() and results in a null-pointer dereference. An attacker able to supply crafted URB receive data with manipulated packet lengths can therefore crash the kernel, causing a denial of service; no confidentiality or integrity impact is expected. The fix is currently deferred for the affected Red Hat Enterprise Linux 8 and 9 update streams; since the demonstrated impact is limited to availability, the residual risk of deferral is a system crash on systems that process crafted mt7601u receive data. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products. Red Hat's Moderate rating (CVSS 6.5) differs from the upstream CVE record's Important rating (CVSS 8.3, which includes confidentiality and integrity impacts) because the verified technical evidence demonstrates only a null-pointer dereference leading to a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.