{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-52530","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-20T12:30:33.318Z","datePublished":"2024-03-02T21:52:34.966Z","dateUpdated":"2026-08-05T09:10:24.738Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:10:24.738Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix potential key use-after-free\n\nWhen ieee80211_key_link() is called by ieee80211_gtk_rekey_add()\nbut returns 0 due to KRACK protection (identical key reinstall),\nieee80211_gtk_rekey_add() will still return a pointer into the\nkey, in a potential use-after-free. This normally doesn't happen\nsince it's only called by iwlwifi in case of WoWLAN rekey offload\nwhich has its own KRACK protection, but still better to fix, do\nthat by returning an error code and converting that to success on\nthe cfg80211 boundary only, leaving the error for bad callers of\nieee80211_gtk_rekey_add()."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The UAF is reached when processing WoWLAN GTK rekey material that originated from WiFi rekeying while suspended; a malicious or compromised AP on the same wireless segment can trigger that rekey path on resume.\nAC:L - This is a deterministic use-after-free once an identical GTK is passed into ieee80211_gtk_rekey_add() and the returned key_conf is used; an adjacent attacker who controls rekeying can drive that condition without relying on an uncontrolled race.\nPR:N - No privileges on the victim host are required; an unauthenticated adjacent WiFi peer/AP can induce GTK rekey during WoWLAN without local credentials or capabilities.\nUI:N - Exploitation does not need a deliberate user action beyond normal association and suspend/WoWLAN operation, which occurs automatically on typical laptops and phones.\nS:U - Impact remains within the local kernel/host trust boundary; this is a standard in-kernel UAF privilege-escalation class bug, not a VM/IOMMU/sandbox escape.\nC:H - Use-after-free of the ieee80211_key object lets an attacker reclaim and read attacker-controlled substitute memory, enabling arbitrary kernel information disclosure.\nI:H - The resume path immediately writes RX sequence/PN state through the freed key_conf via ieee80211_set_key_rx_seq(), giving a heap UAF write primitive suitable for control-flow hijacking.\nA:H - Dereferencing or mutating the freed key reliably causes kernel oops/panic even when not fully exploited, so availability impact is high."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/cfg.c","net/mac80211/key.c"],"versions":[{"version":"fdf7cb4185b60c68e1a75e61691c4afdc15dea0e","lessThan":"2408f491ff998d674707725eadc47d8930aced09","status":"affected","versionType":"git"},{"version":"fdf7cb4185b60c68e1a75e61691c4afdc15dea0e","lessThan":"e8e599a635066c50ac214c3e10858f1d37e03022","status":"affected","versionType":"git"},{"version":"fdf7cb4185b60c68e1a75e61691c4afdc15dea0e","lessThan":"e8a834eb09bb95c2bf9c76f1a28ecef7d8c439d0","status":"affected","versionType":"git"},{"version":"fdf7cb4185b60c68e1a75e61691c4afdc15dea0e","lessThan":"2f4e16e39e4f5e78248dd9e51276a83203950b36","status":"affected","versionType":"git"},{"version":"fdf7cb4185b60c68e1a75e61691c4afdc15dea0e","lessThan":"65c72a7201704574dace708cbc96a8f367b1491d","status":"affected","versionType":"git"},{"version":"fdf7cb4185b60c68e1a75e61691c4afdc15dea0e","lessThan":"31db78a4923ef5e2008f2eed321811ca79e7f71b","status":"affected","versionType":"git"},{"version":"ef810e7c3d2a8fb3bbd23726599c487c30ea747e","status":"affected","versionType":"git"},{"version":"a0a8a11d1630cd648dc1ce86da620b4e240e0315","status":"affected","versionType":"git"},{"version":"6891c6fd2a500d1f39d1426765f610bdc2c2a39d","status":"affected","versionType":"git"},{"version":"003aa22c9619b49efe950aca3aebd1235a04940d","status":"affected","versionType":"git"},{"version":"6440f0ee8a1779f53526bccb9de00914daeb9094","status":"affected","versionType":"git"},{"version":"2586fa0007dc6b7745da14250be7e3aae706b128","status":"affected","versionType":"git"},{"version":"a9ab1b2e30e898440a22d7b1d7a5b0b7c6a8791f","status":"affected","versionType":"git"},{"version":"3.2.95","lessThan":"3.3","status":"affected","versionType":"semver"},{"version":"3.16.50","lessThan":"3.17","status":"affected","versionType":"semver"},{"version":"3.18.82","lessThan":"3.19","status":"affected","versionType":"semver"},{"version":"4.1.47","lessThan":"4.2","status":"affected","versionType":"semver"},{"version":"4.4.99","lessThan":"4.5","status":"affected","versionType":"semver"},{"version":"4.9.63","lessThan":"4.10","status":"affected","versionType":"semver"},{"version":"4.13.14","lessThan":"4.14","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/cfg.c","net/mac80211/key.c"],"versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","status":"unaffected","versionType":"semver"},{"version":"5.4.285","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.228","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.169","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.57","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.5.7","lessThanOrEqual":"6.5.*","status":"unaffected","versionType":"semver"},{"version":"6.6","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.4.285"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.10.228"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.15.169"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.1.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.5.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.95"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18.82"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.47"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.99"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.63"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2408f491ff998d674707725eadc47d8930aced09"},{"url":"https://git.kernel.org/stable/c/e8e599a635066c50ac214c3e10858f1d37e03022"},{"url":"https://git.kernel.org/stable/c/e8a834eb09bb95c2bf9c76f1a28ecef7d8c439d0"},{"url":"https://git.kernel.org/stable/c/2f4e16e39e4f5e78248dd9e51276a83203950b36"},{"url":"https://git.kernel.org/stable/c/65c72a7201704574dace708cbc96a8f367b1491d"},{"url":"https://git.kernel.org/stable/c/31db78a4923ef5e2008f2eed321811ca79e7f71b"}],"title":"wifi: mac80211: fix potential key use-after-free","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-21T16:13:28.190835Z","id":"CVE-2023-52530","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-21T16:13:37.206Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/2f4e16e39e4f5e78248dd9e51276a83203950b36","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/65c72a7201704574dace708cbc96a8f367b1491d","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/31db78a4923ef5e2008f2eed321811ca79e7f71b","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T20:36:15.265Z"}}]}}