CVE-2023-54286 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the iwl_keyinfo.key field.
Add a check to not copy more data to iwl_keyinfo.key then will fit.
This fixes backtraces like this one:
memcpy: detected field-spanning write (size 32) of single field "sta_cmd.key.key" at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (size 16) WARNING: CPU: 1 PID: 946 at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm]
<snip> Hardware name: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017 RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm]
<snip> Call Trace: <TASK> iwl_set_dynamic_key+0x1f0/0x220 [iwldvm]
iwlagn_mac_set_key+0x1e4/0x280 [iwldvm]
drv_set_key+0xa4/0x1b0 [mac80211]
ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211]
ieee80211_key_replace+0x22d/0x8e0 [mac80211]
<snip>
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability identified as CVE-2023-54286 affects the Linux kernel's wireless networking subsystem, specifically within the iwlwifi driver for Intel wireless adapters. This issue manifests as a buffer overflow condition that occurs during the processing of TKIP (Temporal Key Integrity Protocol) encryption keys. The problem stems from an inadequate bounds check when copying key material into a fixed-size buffer structure, creating a potential avenue for memory corruption and system instability. The vulnerability is classified under CWE-121 as a stack-based buffer overflow, which represents a fundamental memory safety issue that can lead to arbitrary code execution or system crashes.
The technical flaw exists in the dvm (device virtual machine) component of the iwlwifi driver where the function iwlagn_send_sta_key processes station key information. When a TKIP key is received, it can potentially contain up to 32 bytes of data including MIC (Message Integrity Code) keys for both receive and transmit operations. However, the internal iwl_keyinfo.key field is only 16 bytes in size, creating a clear mismatch between the source data size and destination buffer capacity. The kernel's memory management system detects this field-spanning write operation during the memcpy operation at line 1103 in the sta.c file, triggering a kernel warning and potential system crash. This condition represents a classic buffer overflow vulnerability that violates the principle of least privilege and proper input validation.
The operational impact of this vulnerability extends beyond simple system instability to potentially enable privilege escalation and denial of service attacks. When exploited, the buffer overflow can corrupt adjacent memory regions, leading to unpredictable behavior including kernel panic, system reboot, or in more severe cases, arbitrary code execution within kernel space. The attack surface is primarily limited to systems running the affected Linux kernel versions with Intel wireless adapters that support TKIP encryption, particularly in enterprise environments where wireless security protocols are actively utilized. The vulnerability affects the wireless networking stack at the kernel level, making it a critical concern for system administrators managing wireless infrastructure. According to ATT&CK framework, this vulnerability maps to T1059.007 for kernel-level command execution and T1499.004 for network denial of service attacks.
Mitigation strategies for CVE-2023-54286 should prioritize immediate kernel updates from the Linux kernel maintainers, as the fix involves implementing proper bounds checking before memory copying operations. System administrators should ensure that wireless networks are updated to kernel versions containing the patched iwlwifi driver, specifically addressing the memcpy operation in the sta.c file. Additional defensive measures include disabling TKIP encryption where possible and implementing network monitoring to detect anomalous wireless traffic patterns that might indicate exploitation attempts. The fix requires modifying the key copying logic to verify that the source data size does not exceed the destination buffer capacity, effectively preventing the field-spanning write condition that triggers the kernel's memory safety detection mechanisms. Organizations should also consider implementing network segmentation and access controls to limit potential attack vectors through wireless interfaces.