CVE-2024-53156

What it actually does

Insufficient validation of conn_rsp_epid allows an out-of-bounds array index into the htc_endpoint array in htc_connect_service(), triggering UBSAN array-index-out-of-bounds in htc_issue_send during firmware request handling.

Why it matters to the business

Kernel instability or crashes on affected Linux wireless systems can interrupt network connectivity and require reboots, with elevated urgency for organizations running unpatched kernels in production environments.

How an attack unfolds

An attacker supplies a crafted connection response containing an out-of-range conn_rsp_epid value that bypasses checks in htc_connect_service(); the value is later used as an array index in htc_issue_send, causing the out-of-bounds access during ath9k WMI command processing.

How to fix it

Apply the upstream fix adding the conn_rsp_epid range check (commit 5f177fb9d01355ac183e65ad8909ea8ef734e0cf) and update to a kernel containing the patch; verify the fix is present in the running kernel source or distribution package.

How to confirm the fix worked

Confirm the range check for conn_rsp_epid exists in htc_connect_service() in drivers/net/wireless/ath/ath9k/htc_hst.c and test with a fuzzer or reproducer that previously triggered the UBSAN report; ensure no out-of-bounds warning occurs on the patched kernel.

Typical attack path

1. Send malformed HTC service connection response over the wireless interface
2. Trigger htc_connect_service() without range validation on conn_rsp_epid
3. Cause htc_issue_send to dereference an invalid endpoint index
4. Induce UBSAN fault or memory corruption during kworker firmware handling

How to detect it

Review kernel logs for UBSAN array-index-out-of-bounds messages referencing htc_issue_send or htc_endpoint; correlate with ath9k driver activity and kworker firmware request events.

What your security team should do

• Prioritize patching Linux kernels containing the ath9k driver on all affected systems
• Monitor for kernel oops or UBSAN reports involving htc_endpoint indexing
• Restrict untrusted wireless associations until patches are deployed