LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53570: wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() nl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the number of MBSSID elements in the nested netlink attribute attrs, which can lead to an integer overflow if a user of the nl80211 interface specifies 256 or more elements in the corresponding attribute in userspace. The integer overflow can lead to a heap buffer overflow as num_elems determines the size of the trailing array in elems, and this array is thereafter written to for each element in attrs. Note that this vulnerability only affects devices with the wiphy->mbssid_max_interfaces member set for the wireless physical device struct in the device driver, and can only be triggered by a process with CAP_NET_ADMIN capabilities. Fix this by checking for a maximum of 255 elements in attrs.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-53570 is a Linux kernel wireless networking flaw where an oversized MBSSID netlink attribute can overflow an internal counter and corrupt heap memory. The source says exploitation requires CAP_NET_ADMIN and only affects wireless devices whose driver enables mbssid_max_interfaces, so broad remote exposure is not supported by the evidence.

Executive priority

Treat as a targeted kernel hardening issue, not an internet-wide emergency based on current evidence. Patch through normal kernel security maintenance, with faster handling for Linux systems using Wi-Fi hardware or granting CAP_NET_ADMIN to workloads.

Technical view

In nl80211_parse_mbssid_elems(), num_elems is a u8 count of nested MBSSID elements. Supplying 256 or more elements can wrap the count, under-allocate the trailing elems array, then write past it. The fix enforces a maximum of 255 elements. The CVE record lists affected Linux kernel versions including 5.16, 6.1.46, 6.4.11, and 6.5.

Likely exposure

Exposure is limited to Linux systems using affected kernel versions with wireless physical devices whose drivers set wiphy->mbssid_max_interfaces. Triggering requires a process with CAP_NET_ADMIN, reducing risk for standard unprivileged users but leaving concern for privileged containers, network management services, or compromised admin-level processes.

Exploitation context

The supplied sources do not state active exploitation, public exploit availability, or KEV listing. The described trigger is local or userspace access to the nl80211 interface with CAP_NET_ADMIN, not unauthenticated remote network traffic.

Researcher notes

Key constraints are explicit: mbssid_max_interfaces must be set by the wireless driver, and CAP_NET_ADMIN is required. Severity and CVSS are not provided in the supplied bundle, and the record does not name distributions, exploit maturity, or operational indicators.

Mitigation direction

  • Apply vendor-provided Linux kernel updates containing the referenced stable fixes.
  • Prioritize systems with Wi-Fi hardware and services holding CAP_NET_ADMIN.
  • Restrict CAP_NET_ADMIN from containers and applications unless operationally required.
  • Review vendor advisories for distribution-specific fixed package versions.
  • Monitor kernel and distribution security channels for backport status.

Validation and detection

  • Inventory Linux kernel versions against distribution security advisories.
  • Identify hosts with Wi-Fi devices and drivers supporting MBSSID interfaces.
  • Audit services, containers, and users granted CAP_NET_ADMIN.
  • Confirm patched kernels include the maximum-255 MBSSID element check.
  • Track remediation evidence in vulnerability management records.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53570 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdc1e3cb8da8b414b37208b2fb6755fef8122504b, dc1e3cb8da8b414b37208b2fb6755fef8122504b, dc1e3cb8da8b414b37208b2fb6755fef8122504bunaffected
LinuxLinux5.16, 0, 6.1.46, 6.4.11, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.