CVE-2023-52530

HighCVSS 7.8/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix potential key use-after-free

When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will still return a pointer into the key, in a potential use-after-free. This normally doesn't happen since it's only called by iwlwifi in case of WoWLAN rekey offload which has its own KRACK protection, but still better to fix, do that by returning an error code and converting that to success on the cfg80211 boundary only, leaving the error for bad callers of ieee80211_gtk_rekey_add().

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Mar 2, 2024
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-525317.8In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, sCVE-2023-525325.5In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TX CQE error handling For an unknown TX CQE error type CVE-2023-525335.3In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosuCVE-2023-525345.9In ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote denial of service with no additioCVE-2023-525354.4In vsp driver, there is a possible missing verification incorrect input. This could lead to local denial of service with no additional execuCVE-2023-525364.4In faceid service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with SysCVE-2023-525377.5Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will afCVE-2023-525389.1Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will afCVE-2023-525397.5Permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confiCVE-2023-52545.3The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_chaCVE-2023-525407.5Vulnerability of improper authentication in the Iaware module. Impact: Successful exploitation of this vulnerability will affect availabilitCVE-2023-525417.5Authentication vulnerability in the API for app pre-loading. Impact: Successful exploitation of this vulnerability may affect service confid