BaseFortify

Publication date: 2025-10-04

Last updated on: 2026-03-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() nl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the number of MBSSID elements in the nested netlink attribute attrs, which can lead to an integer overflow if a user of the nl80211 interface specifies 256 or more elements in the corresponding attribute in userspace. The integer overflow can lead to a heap buffer overflow as num_elems determines the size of the trailing array in elems, and this array is thereafter written to for each element in attrs. Note that this vulnerability only affects devices with the wiphy->mbssid_max_interfaces member set for the wireless physical device struct in the device driver, and can only be triggered by a process with CAP_NET_ADMIN capabilities. Fix this by checking for a maximum of 255 elements in attrs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-04

Last Modified

2026-03-21

Generated

2026-07-06

AI Q&A

2025-10-04

EPSS Evaluated

2026-07-05

NVD

CVE-2023-53570

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.5
linux	linux_kernel	From 5.15.160 (inc) to 5.16 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in the Linux kernel's nl80211_parse_mbssid_elems() function. The function uses an 8-bit unsigned integer (u8) to count the number of MBSSID elements, which can overflow if 256 or more elements are specified by a user with CAP_NET_ADMIN privileges. This overflow leads to a heap buffer overflow because the count determines the size of an array that is then written to, potentially causing memory corruption.

Impact Analysis

If exploited, this vulnerability can cause a heap buffer overflow in the Linux kernel's wireless subsystem. This could potentially allow an attacker with CAP_NET_ADMIN capabilities to execute arbitrary code, cause a denial of service, or crash the system by corrupting memory.

Mitigation Strategies

To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the fix for CVE-2023-53570 has been applied. The fix involves checking for a maximum of 255 MBSSID elements to prevent integer overflow. Additionally, restrict processes with CAP_NET_ADMIN capabilities from untrusted users to reduce the risk of exploitation.

Hi! I’m here to help you understand CVE-2023-53570. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70