CVE-2023-54286

A vulnerability was discovered in the Intel wireless iwlwifi driver in the Linux kernel that could lead to a buffer overflow in the Driver Virtualization Module key handling code. When processing a received TKIP key that includes MIC rx/tx components, the driver did not adequately limit the amount of key data copied into the fixed-length iwl_keyinfo.key field, potentially causing a field-spanning write and kernel backtrace (crash).

A flaw of IMPORTANT severity was found in the Linux kernel's Intel wireless iwlwifi DVM driver. When a TKIP key that includes MIC rx/tx key material is installed on an affected Intel wireless device, the driver copies up to 32 bytes of key data into the fixed 16-byte iwl_keyinfo.key field without adequately limiting the copied length, causing a field-spanning out-of-bounds write in iwlagn_send_sta_key. This triggers a kernel WARNING and backtrace and can crash the system, resulting in denial of service. Red Hat rates this issue as local with high attack complexity and required privileges (CVSS 3.1 base score 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), since exploitation requires the ability to set a TKIP key on the affected hardware; this differs from the upstream CVE.org score of 7.6, which is based on an adjacent-network vector. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt releases are NOTAFFECTED for this vulnerability because the vulnerable code is not present in shipped versions: the length check that prevents the overflow was already incorporated, so no Red Hat products require remediation for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.