{ "schema_version": "1.6.1", "id": "RPI-CVE-2023-53257", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2023-53257" ], "published": "2025-09-15T14:48:04Z", "summary": "wifi: mac80211: check S1G action frame size", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check S1G action frame size\n\nBefore checking the action code, check that it even\nexists in the frame.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.21-1+rpt1", "1:6.1.47-1+rpt2", "1:6.1.47-1+rpt4", "1:6.1.54-1+rpt2" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi1-rpi-v6", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi1-rpi-v7", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi1-rpi-v7l", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi1-rpi-v8", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v6", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v7", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v7l", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v8", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-2712", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-v6", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-v7", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-v7l", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-v8", "binary_version": "1:6.1.54-1+rpt2" } ] }, "database_specific": { "per_version": { "1:6.1.21-1+rpt1": { "linux_commit": "0afb5e98488aed7017b9bf321b575d0177feb7ed", "upstream_version": "6.1.21", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.55" }, "1:6.1.47-1+rpt2": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.55" }, "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.55", "compiled_filter": false }, "1:6.1.54-1+rpt2": { "linux_commit": "2906f7abdc03d4a92b6b0e2e0c87ea2a9dffe8f7", "upstream_version": "6.1.54", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.55" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2023-53257" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/fedd9377dd9c71a950d432fbe1628eebfbed70a1" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/7ae7a1378a119780c8c17a6b5fc03011c3bb7029" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/5e030a2509be72b452b6f4a800786d43229414db" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/19e4a47ee74718a22e963e8a647c8c3bfe8bb05c" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T11:24:39Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.1, "cvss_v3_severity": "High", "scenario": "AV:A - The bug is in ieee80211_rx_h_action() on the mac80211 Wi\u2011Fi RX path; an attacker on the same radio/LAN segment injects a truncated S1G action frame (category present, action_code missing). Wi\u2011Fi frame injection is Adjacent, not Network or Local.\nAC:L - The attacker fully controls frame length and contents and can deterministically send a 25-byte action frame (IEEE80211_MIN_ACTION_SIZE) with WLAN_CATEGORY_S1G; no race or attacker-uncontrollable condition is required.\nPR:N - S1G action frames are non-robust, so MFP does not require encryption; an unauthenticated adjacent peer who is associated (e.g. open AP) or who spoofs an associated STA\u2019s MAC reaches the path with no local account or capability on the victim.\nUI:N - The attacker triggers the path solely by transmitting the crafted management frame; no separate victim action (mount, open, click) is required beyond the interface already receiving Wi\u2011Fi frames.\nS:U - The out-of-bounds/uninit read and any resulting fault stay inside the host kernel mac80211 authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:L - The defect is a strictly 1-byte out-of-bounds/uninit read of s1g.action_code past skb->len into adjacent/uninitialized skb memory, used only in a switch; that is a small bounded read, not an arbitrary read primitive, so Confidentiality is Low.\nI:N - This is a read-only length-check omission with no OOB write, UAF, or control-flow write primitive; the TWT follow-on path has its own length checks and does not grant an integrity or code-execution primitive.\nA:H - Reading past valid frame data into invalid/unmapped skb memory can oops/panic the kernel (as reflected by the KMSAN finding that motivated the fix), and an adjacent peer can trigger this repeatedly, so Availability is High." } } }