CVE-2023-54286

What it actually does

Out-of-bounds write via memcpy when a TKIP key (up to 32 bytes including MIC keys) is copied into the 16-byte iwl_keyinfo.key field in drivers/net/wireless/intel/iwlwifi/dvm/sta.c without length validation.

Why it matters to the business

Wireless network drivers on affected Linux systems can trigger kernel warnings or crashes during key installation, leading to loss of Wi-Fi connectivity and potential system instability until patched.

How an attack unfolds

An attacker supplies a TKIP key containing MIC data through the mac80211 key management path; iwlagn_mac_set_key calls into iwl_set_dynamic_key which invokes iwlagn_send_sta_key and performs an unchecked memcpy that overflows the destination field, producing a field-spanning write warning.

How to fix it

Upgrade the Linux kernel to a version containing commit 76b5ea43ad2fb4f726ddfaff839430a706e7d7c2 or later; rebuild and reboot with the patched driver.

How to confirm the fix worked

Confirm the running kernel contains commit 76b5ea43ad2fb4f726ddfaff839430a706e7d7c2; reproduce a TKIP key installation and verify absence of the memcpy field-spanning write warning in dmesg.

Typical attack path

1. Trigger IEEE 802.11 key installation for a TKIP cipher with MIC keys present
2. mac80211 invokes drv_set_key and ieee80211_key_enable_hw_accel
3. iwlwifi dvm code reaches iwlagn_send_sta_key
4. memcpy writes 32 bytes into the 16-byte sta_cmd.key.key field
5. Kernel emits field-spanning write warning and stack trace

How to detect it

Search kernel logs (dmesg, journalctl) for the exact warning 'memcpy: detected field-spanning write (size 32) of single field "sta_cmd.key.key"' and the function iwlagn_send_sta_key; correlate with Wi-Fi key installation events.

• memcpy: detected field-spanning write (size 32) of single field "sta_cmd.key.key"
• iwlagn_send_sta_key+0x375/0x390 [iwldvm]
• WARNING: CPU.*iwlagn_send_sta_key

What your security team should do

• Apply the referenced upstream commit immediately on systems using Intel wireless cards with the dvm driver
• Monitor dmesg for the memcpy warning string until patches are deployed
• Prioritize updates on endpoints that frequently roam or rekey TKIP networks