In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
An integer overflow occurs in the iwl_write_to_user_buf() function,
which is called by the iwl_dbgfs_monitor_data_read() function.
static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count,
void *buf, ssize_t *size,
ssize_t *bytes_copied)
{
int buf_size_left = count - *bytes_copied;
buf_size_left = buf_size_left - (buf_size_left % sizeof(u32));
if (*size > buf_size_left)
*size = buf_size_left;
If the user passes a SIZE_MAX value to the "ssize_t count" parameter,
the ssize_t count parameter is assigned to "int buf_size_left".
Then compare "*size" with "buf_size_left" . Here, "buf_size_left" is a
negative number, so "*size" is assigned "buf_size_left" and goes into
the third argument of the copy_to_user function, causing a heap overflow.
This is not a security vulnerability because iwl_dbgfs_monitor_data_read()
is a debugfs operation with 0400 privileges.
References
Configurations
Configuration 1 (hide)
|
History
26 Jan 2026, 20:02
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| References | () https://git.kernel.org/stable/c/059e426d666a41e26b184c177c1ca3ee2d6fa1b6 - Patch | |
| References | () https://git.kernel.org/stable/c/0ad8dd870aa187d0c21d032bb2c6433559075eec - Patch | |
| References | () https://git.kernel.org/stable/c/58d1b717879bfeabe09b35e41ad667c79933eb2e - Patch | |
| References | () https://git.kernel.org/stable/c/82f877ec9b041edc4c7c509c605cc3393d837bf0 - Patch | |
| References | () https://git.kernel.org/stable/c/de78456976026102babe66258c228691ca5677c0 - Patch | |
| References | () https://git.kernel.org/stable/c/eb1ef44efac797b384d361a76e33f77027c29a14 - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| First Time |
Linux
Linux linux Kernel |
|
| CWE | CWE-190 |
01 Oct 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-01 12:15
Updated : 2026-01-26 20:02
NVD link : CVE-2023-53524
Mitre link : CVE-2023-53524
CVE.ORG link : CVE-2023-53524
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-190
Integer Overflow or Wraparound