CVE-2023-1380

What it actually does

Out-of-bounds read in brcmf_get_assoc_ies when assoc_info->req_len exceeds WL_EXTRA_BUF_MAX buffer size, resulting in denial of service with high confidentiality and availability impact from local context.

Why it matters to the business

Wireless-enabled Linux systems may experience crashes or instability requiring reboots, disrupting network connectivity and operations; low urgency as the issue is not cataloged in CISA KEV or known ransomware campaigns.

How an attack unfolds

A local attacker with standard user privileges supplies oversized association request data to the Broadcom wireless driver, triggering the slab out-of-bounds read and causing a kernel crash or information leak; unrelated mentions of VMSCAPE and container privilege escalation do not alter the core local vector.

How to fix it

Apply the kernel patch at commit f53660ec669f60c772fdf7d75d1c24d288547cee or upgrade to a fixed mainline version containing this change; rebuild and deploy updated kernels across affected systems.

How to confirm the fix worked

Verify the presence of commit f53660ec669f60c772fdf7d75d1c24d288547cee in the running kernel source or confirm wireless driver functions no longer perform the unchecked buffer comparison.

Typical attack path

1. Gain local shell access on a vulnerable Linux system
2. Trigger wireless association or scan operations with malformed request length data
3. Induce slab out-of-bounds read leading to denial of service

How to detect it

Inspect kernel logs for oops or panic entries referencing brcmf_get_assoc_ies or cfg80211.c; correlate with wireless association events from affected Broadcom hardware.

What your security team should do

• Prioritize kernel updates on wireless-enabled endpoints within standard patch cycles
• Monitor for wireless driver-related kernel oops or panics in system logs
• Limit local user privileges where wireless hardware is present until patched