CVE-2023-52832

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: dont return unset power in ieee80211_get_tx_power()

We can get a UBSAN warning if ieee80211_get_tx_power() returns the INT_MIN value mac80211 internally uses for unset power level.

UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5 -2147483648 * 100 cannot be represented in type int CPU: 0 PID: 20433 Comm: insmod Tainted: G WC OE Call Trace: dump_stack+0x74/0x92 ubsan_epilogue+0x9/0x50 handle_overflow+0x8d/0xd0 __ubsan_handle_mul_overflow+0xe/0x10 nl80211_send_iface+0x688/0x6b0 [cfg80211] […] cfg80211_register_wdev+0x78/0xb0 [cfg80211] cfg80211_netdev_notifier_call+0x200/0x620 [cfg80211] […] ieee80211_if_add+0x60e/0x8f0 [mac80211] ieee80211_register_hw+0xda5/0x1170 [mac80211]

In this case, simply return an error instead, to indicate that no data is available.

Weakness

The product operates in an environment in which power is a limited resource that cannot be automatically replenished, but the product does not properly restrict the amount of power that its operation consumes.

Affected Software

Extended Description

In environments such as embedded or mobile devices, power can be a limited resource such as a battery, which cannot be automatically replenished by the product itself, and the device might not always be directly attached to a reliable power source. If the product uses too much power too quickly, then this could cause the device (and subsequently, the product) to stop functioning until power is restored, or increase the financial burden on the device owner because of increased power costs. Normal operation of an application will consume power. However, in some cases, an attacker could cause the application to consume more power than intended, using components such as:

References

• https://git.kernel.org/stable/c/1571120c44dbe5757aee1612c5b6097cdc42710f
• https://git.kernel.org/stable/c/21a0f310a9f3bfd2b4cf4f382430e638607db846
• https://git.kernel.org/stable/c/298e767362cade639b7121ecb3cc5345b6529f62
• https://git.kernel.org/stable/c/2be24c47ac19bf639c48c082486c08888bd603c6
• https://git.kernel.org/stable/c/5a94cffe90e20e8fade0b9abd4370bd671fe87c7
• https://git.kernel.org/stable/c/717de20abdcd1d4993fa450e28b8086a352620ea
• https://git.kernel.org/stable/c/adc2474d823fe81d8da759207f4f1d3691aa775a
• https://git.kernel.org/stable/c/e160ab85166e77347d0cbe5149045cb25e83937f
• https://git.kernel.org/stable/c/efeae5f4972f75d50002bc50eb112ab9e7069b18