CVE-2023-53715
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-10-22
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Linux kernel's wifi driver brcmfmac and its handling of the PMK (Pairwise Master Key). Previously, the PMK was passed in hex format, which does not work correctly on newer chips/firmware like BCM4387. The fix changes the mechanism to pass the PMK in binary format instead of hex. Additionally, the structure used to pass the PMK is cleared before setting it, preventing leakage of uninitialized stack contents to the device.
How can this vulnerability impact me? :
The vulnerability could cause improper handling of the PMK on newer wifi chips, potentially leading to connectivity issues or failures in wifi authentication. Moreover, the previous method leaked uninitialized stack contents to the device, which could expose sensitive information or lead to security risks related to information leakage.
What immediate steps should I take to mitigate this vulnerability?
Apply the updated Linux kernel patch that changes the brcmfmac driver to pass the PMK in binary instead of hex and clears the structure before setting the PMK to avoid leaking uninitialized stack contents. This update resolves the issue with newer chips/firmware such as BCM4387.