CVE-2023-53717

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()<br /> <br /> Fix a stack-out-of-bounds write that occurs in a WMI response callback<br /> function that is called after a timeout occurs in ath9k_wmi_cmd().<br /> The callback writes to wmi-&gt;cmd_rsp_buf, a stack-allocated buffer that<br /> could no longer be valid when a timeout occurs. Set wmi-&gt;last_seq_id to<br /> 0 when a timeout occurred.<br /> <br /> Found by a modified version of syzkaller.<br /> <br /> BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx<br /> Write of size 4<br /> Call Trace:<br /> memcpy<br /> ath9k_wmi_ctrl_rx<br /> ath9k_htc_rx_msg<br /> ath9k_hif_usb_reg_in_cb<br /> __usb_hcd_giveback_urb<br /> usb_hcd_giveback_urb<br /> dummy_timer<br /> call_timer_fn<br /> run_timer_softirq<br /> __do_softirq<br /> irq_exit_rcu<br /> sysvec_apic_timer_interrupt