Bug 2215892 (CVE-2023-3317) - CVE-2023-3317 kernel: use-after-free in wifi mt7921 fw features query [NEEDINFO]
Summary: CVE-2023-3317 kernel: use-after-free in wifi mt7921 fw features query
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2023-3317
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2203731
TreeView+ depends on / blocked
 
Reported: 2023-06-19 10:37 UTC by Rohit Keshri
Modified: 2023-07-26 13:45 UTC (History)
46 users (show)

Fixed In Version: Kernel 6.3-rc6
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free flaw was found in mt7921_check_offload_capability in drivers/net/wireless/mediatek/mt76/mt7921/init.c in the wifi mt76/mt7921 sub-component of the Linux Kernel. This issue could allow an attacker to crash the system after the 'features' memory releases which could lead to a kernel information leak.
Clone Of:
Environment:
Last Closed: 2023-06-19 21:38:55 UTC
Embargoed:
jpazdziora: needinfo? (rkeshri)

Attachments (Terms of Use)

Description Rohit Keshri 2023-06-19 10:37:16 UTC 
A use-after-free flaw was found in mt7921_check_offload_capability in drivers/net/wireless/mediatek/mt76/mt7921/init.c in wifi mt76/mt7921 sub-component in the Linux Kernel. This flaw could allow an attacker to crash the system after 'features' memory release. This vulnerability could even lead to a kernel information leak problem.

Refer:
https://patchwork.kernel.org/project/linux-wireless/patch/51fd8f76494348aa9ecbf0abc471ebe47a983dfd.1679502607.git.lorenzo@kernel.org/
Comment 4 Product Security DevOps Team 2023-06-19 21:38:51 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-3317
Comment 5 Jan Pazdziora 2023-07-26 13:45:37 UTC 
Hello Rohit,

while doing review of the Vulnerability Assessment report of RHEL 8.6 for the purpose of Common Criteria certification, we came across this CVE. In comment 1 you mention that both RHEL 8 and RHEL 9 already have a fix.

Could you elaborate when the fix went in to RHEL 8?

Thank you, Jan
Note You need to log in before you can comment on or make changes to this bug.