{
  "cveId": "CVE-2023-52531",
  "url": "https://patchblox.com/security/cve/CVE-2023-52531",
  "summary": "CVE-2023-52531 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-52531, released March 2, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: iwlwifi: mvm: Fix a memory corruption issu...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  wifi: iwlwifi: mvm: Fix a memory corruption issue  A few lines above, space is kzalloc()\u0027ed for: \tsizeof(struct iwl_nvm_data) \u002B \tsizeof(struct ieee80211_channel) \u002B \tsizeof(struct ieee80211_rate)  \u0027mvm-\u003Envm_data\u0027 is a \u0027struct iwl_nvm_data\u0027, so it is fine.  At the end of this structure, there is the \u0027channels\u0027 flex array. Each element is of type \u0027struct ieee80211_channel\u0027. So only 1 element is allocated in this array.  When doing:   mvm-\u003Envm_data-\u003Ebands[0].channels = mvm-\u003Envm_data-\u003Echannels; We point at the first element of the \u0027channels\u0027 flex array. So this is fine.  However, when doing:   mvm-\u003Envm_data-\u003Ebands[0].bitrates = \t\t\t(void *)((u8 *)mvm-\u003Envm_data-\u003Echannels \u002B 1); because of the \u0022(u8 *)\u0022 cast, we add only 1 to the address of the beginning of the flex array.  It is likely that we want point at the \u0027struct ieee80211_rate\u0027 allocated just after.  Remove the spurious casting so that the pointer arithmetic works as expected.",
  "published": "2024-03-02T22:15:48Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00237,
  "epssPercentile": 0.14763,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.64-1",
      "fix": "DEBIAN-CVE-2023-52531",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52531",
      "released": "2024-03-02T22:15:48Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.5.8-1",
      "fix": "DEBIAN-CVE-2023-52531",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52531",
      "released": "2024-03-02T22:15:48Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.5.8-1",
      "fix": "DEBIAN-CVE-2023-52531",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52531",
      "released": "2024-03-02T22:15:48Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}