CVE-2023-1380 : A slab-out-of-bound read problem was found in brcmf_get_assoc

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.

Published 2023-03-27 21:15:11

Updated 2023-12-08 20:45:02

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2023-1380

Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 9.0
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.10 and before (<) 5.10.180
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.19 and before (<) 4.19.283
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.15 and before (<) 5.15.110
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.4 and before (<) 5.4.243
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.2.1 and before (<) 4.14.315
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 6.1 and before (<) 6.1.27
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 6.2 and before (<) 6.2.14
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 6.3 Update RC1
cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 6.3 Update RC2
cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 6.3 Update RC3
cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 6.3 Update RC4
cpe:2.3:o:linux:linux_kernel:6.3:rc4:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 6.3 Update RC5
cpe:2.3:o:linux:linux_kernel:6.3:rc5:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 6.3 Update RC6
cpe:2.3:o:linux:linux_kernel:6.3:rc6:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 6.3
cpe:2.3:o:linux:linux_kernel:6.3:-:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 6.3 Update RC7
cpe:2.3:o:linux:linux_kernel:6.3:rc7:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 20.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 22.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
Matching versions
Netapp » H410c Firmware » Version: N/A
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410c » Version: N/A
Netapp » H300s Firmware » Version: N/A
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H300s » Version: N/A
Netapp » H500s Firmware » Version: N/A
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H500s » Version: N/A
Netapp » H700s Firmware » Version: N/A
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H700s » Version: N/A
Netapp » H410s Firmware » Version: N/A
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410s » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-1380

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 14 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-1380

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.1	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	1.8	5.2	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: High

CWE ids for CVE-2023-1380

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.
Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)

References for CVE-2023-1380

http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html

Kernel Live Patch Security Notice LSN-0095-1 ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url
http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html

Kernel Live Patch Security Notice LSN-0096-1 ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=2177883

2177883 – (CVE-2023-1380) CVE-2023-1380 Kernel: a USB-accessible slab-out-of-bounds read in brcmfmac
Issue Tracking;Mitigation;Patch;Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/03/14/1

oss-security - Re: A USB-accessible slab-out-of-bounds read in Linux kernel driver
Mailing List;Third Party Advisory
https://www.debian.org/security/2023/dsa-5480

Debian -- Security Information -- DSA-5480-1 linux
Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html

[SECURITY] [DLA 3508-1] linux security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html

[SECURITY] [DLA 3623-1] linux-5.10 security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20230511-0001/

CVE-2023-1380 Linux Kernel Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://lore.kernel.org/linux-wireless/20230309104457.22628-1-jisoo.jang@yonsei.ac.kr/T/#u

[PATCH v2] wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
Mailing List;Patch
https://lore.kernel.org/linux-wireless/20230309104457.22628-1-jisoo.jang%40yonsei.ac.kr/T/#u

[PATCH v2] wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
Patch

Jump to

Vulnerability Details : CVE-2023-1380

Products affected by CVE-2023-1380

Exploit prediction scoring system (EPSS) score for CVE-2023-1380

CVSS scores for CVE-2023-1380

CWE ids for CVE-2023-1380

References for CVE-2023-1380