LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54300: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should validate pkt_len before accessing the SKB. For example, the obtained SKB may have been badly constructed with pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr but after being processed in ath9k_htc_rx_msg() and passed to ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI command header which should be located inside its data payload. Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit memory can be referenced. Tested on Qualcomm Atheros Communications AR9271 802.11n . Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-54300 is a Linux kernel Wi-Fi driver flaw in ath9k. A badly formed short packet can make the driver reference uninitialized memory. The public record names kernel stable fixes, but provides no CVSS score, CWE, or evidence of active exploitation.

Executive priority

Treat as a kernel maintenance item for fleets with affected Atheros Wi-Fi hardware. Prioritize patching exposed laptops, appliances, or embedded Linux systems using ath9k, but do not escalate as actively exploited based on the supplied evidence.

Technical view

The issue is in ath9k_wmi_ctrl_rx after ath9k_htc_rx_msg processes an SKB whose pkt_len may be too small to contain the expected WMI command header. The fix adds sanity checking before payload access. The report was found with Syzkaller and tested on Qualcomm Atheros AR9271 hardware.

Likely exposure

Exposure is most likely on Linux systems using the ath9k HTC Wi-Fi driver and compatible Qualcomm Atheros devices. The source bundle lists affected Linux version ranges and stable kernel fix commits, but the exact downstream distribution package status must be checked per vendor.

Exploitation context

The CVE record does not state active exploitation, and KEV status is false. The available evidence shows a fuzzing-discovered kernel driver memory-safety issue involving malformed packet length handling, not a documented real-world attack campaign.

Researcher notes

Key uncertainty is impact. Sources only state uninitialized memory can be referenced after insufficient pkt_len validation. They do not specify information disclosure, crash reliability, privilege impact, or attacker proximity requirements. Avoid assuming exploitability beyond malformed SKB handling.

Mitigation direction

  • Upgrade to a kernel containing the referenced ath9k stable fixes.
  • Check Linux distribution advisories for backported kernel packages.
  • Reduce exposure of systems using ath9k HTC Wi-Fi hardware where practical.
  • Track vendor guidance because no separate workaround is named in the sources.

Validation and detection

  • Inventory systems with ath9k or ath9k_htc loaded.
  • Map running kernel versions to vendor fixed packages or upstream stable commits.
  • Confirm Qualcomm Atheros AR9271 or related ath9k HTC hardware usage.
  • Review kernel changelogs for the referenced ath9k_wmi_ctrl_rx sanity check.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54300 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfb9987d0f748c983bb795a86f47522313f701a08, fb9987d0f748c983bb795a86f47522313f701a08, fb9987d0f748c983bb795a86f47522313f701a08, fb9987d0f748c983bb795a86f47522313f701a08, fb9987d0f748c983bb795a86f47522313f701a08, fb9987d0f748c983bb795a86f47522313f701a08, fb9987d0f748c983bb795a86f47522313f701a08, fb9987d0f748c983bb795a86f47522313f701a08, fb9987d0f748c983bb795a86f47522313f701a08unaffected
LinuxLinux2.6.35, 0, 4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.