CVE-2023-52594

What it actually does

Out-of-bounds array read in ath9k_htc_txstatus() when txs->cnt from a USB URB exceeds HTC_MAX_TX_STATUS, allowing kernel memory disclosure or crash despite an existing WARN_ON check.

Why it matters to the business

Systems using affected ath9k USB Wi-Fi hardware face risk of local kernel compromise or denial of service, potentially requiring urgent patching on servers, embedded devices, and workstations with high downstream Linux kernel usage.

How an attack unfolds

An attacker with local access or control of a malicious USB device crafts a URB with oversized txs->cnt to bypass the incomplete bounds check in ath9k_htc_txstatus, triggering the read during WMI event handling in the kernel tasklet.

How to fix it

Update the Linux kernel to commit f44f073c78112ff921a220d01b86d09f2ace59bc or later stable releases containing the fix that adds an early return when txs->cnt exceeds HTC_MAX_TX_STATUS.

How to confirm the fix worked

Verify the patch is applied by confirming the early return logic exists after the WARN_ON check in ath9k_htc_txstatus(); test with a modified syzkaller reproducer or USB fuzzing to ensure no out-of-bounds access occurs.

Typical attack path

1. Obtain local user access or attach malicious USB hardware
2. Trigger ath9k HTC TX status event path with crafted URB data
3. Supply txs->cnt value exceeding array bounds
4. Read kernel memory beyond __wmi_event_txstatus or cause UBSAN/panic

How to detect it

Search kernel logs for UBSAN warnings mentioning array-index-out-of-bounds in htc_drv_txrx.c or ath9k_htc_txstatus; inspect tasklet and IRQ exit traces involving ath9k_wmi_event_tasklet.

• UBSAN: array-index-out-of-bounds in htc_drv_txrx.c
• index .* is out of range for type '__wmi_event_txstatus [12]'
• ath9k_htc_txstatus
• ath9k_wmi_event_tasklet

What your security team should do

• Prioritize kernel updates on all systems exposing ath9k USB Wi-Fi to untrusted hardware or local users
• Monitor for UBSAN array-index-out-of-bounds reports in htc_drv_txrx.c
• Disable ath9k HTC support where USB Wi-Fi is unnecessary until patched