CVE-2023-53315

What it actually does

Invalid zero-filled RX descriptor from REO destination ring triggers IDR lookup for buffer ID 0, fetching incorrect SKB and causing memory corruption that leads to kernel paging faults during DMA operations.

Why it matters to the business

Prolonged WiFi traffic on affected systems can trigger random crashes, interrupting network-dependent workloads with low likelihood of exploitation given stable low EPSS and no KEV listing.

How an attack unfolds

An attacker sustains long-duration network traffic to induce a zero descriptor in the REO ring; the driver then dereferences the wrong SKB via IDR, corrupting memory and crashing the kernel. No specific threat actors are known to target this issue.

How to fix it

Apply kernel patches containing commit 866921dc06b94df91acfcf9359b57da943ed99b3 which reserves buffer ID 0 and adds descriptor sanity checks before SKB processing; update to fixed package versions such as bash 4.0-2 where applicable.

How to confirm the fix worked

Confirm presence of IDR allocation starting at 1 and descriptor validation logic in ath11k_dp_process_rx; run extended traffic tests to verify absence of zero-descriptor crashes.

Typical attack path

1. Establish prolonged bidirectional WiFi traffic on ath11k hardware
2. Trigger receipt of zero-filled descriptor from REO destination ring
3. Perform IDR lookup using reserved buffer ID 0
4. Access and corrupt unrelated SKB memory
5. Induce kernel paging fault during DMA cache maintenance

How to detect it

Search kernel logs and crash dumps for the provided backtrace involving ath11k_dp_process_rx, __dma_page_dev_to_cpu, and b15_dma_inv_range; correlate with periods of sustained WiFi activity.

• b15_dma_inv_range+0x30/0x50
• ath11k_dp_process_rx+0x1e8/0x4a4
• Unable to handle kernel paging request at virtual address 3f004900
• ath11k_dp_service_srng

What your security team should do

• Prioritize kernel upgrades on systems with ath11k WiFi hardware
• Monitor crash reports containing ath11k_dp_process_rx and dma_cache_maint_page
• Apply patches within standard maintenance windows given low EPSS and absence from KEV