CVE-2023-52530

What it actually does

Use-after-free in mac80211 ieee80211_gtk_rekey_add() when ieee80211_key_link() returns 0 due to KRACK protection on identical key reinstall, potentially returning a dangling pointer to a freed key structure.

Why it matters to the business

Rare risk of kernel memory corruption or crashes during Wi-Fi GTK rekeying in specific iwlwifi WoWLAN offload scenarios; low operational urgency given no KEV listing, stable low EPSS, and narrow trigger conditions.

How an attack unfolds

An attacker triggers repeated GTK rekey operations under KRACK-protected conditions in a WoWLAN-enabled iwlwifi setup, causing ieee80211_gtk_rekey_add() to return a freed key pointer that may be dereferenced later, leading to use-after-free.

How to fix it

Apply the upstream fix in commit 2408f491ff998d674707725eadc47d8930aced09 or later stable kernel versions containing this change; rebuild and deploy updated kernel images.

How to confirm the fix worked

Verify the presence of commit 2408f491ff998d674707725eadc47d8930aced09 in the running kernel source tree or confirm the patched behavior in ieee80211_gtk_rekey_add() via code review or kernel build logs.

Typical attack path

1. Establish Wi-Fi association with iwlwifi device supporting WoWLAN rekey offload
2. Force or observe GTK rekeying while KRACK protection is active
3. Trigger identical key reinstall path in ieee80211_key_link()
4. Obtain and dereference the dangling key pointer returned by ieee80211_gtk_rekey_add()

How to detect it

Review kernel logs for oops or use-after-free warnings involving mac80211 or ieee80211_key structures during rekey events; correlate with iwlwifi WoWLAN activity.

What your security team should do

• Prioritize kernel update to the fixed commit for all systems using iwlwifi with WoWLAN
• Monitor EPSS and KEV status for any change in exploit maturity
• Test Wi-Fi rekey functionality post-update in lab environments