GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54286 (GCVE-0-2023-54286)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:23 – Updated: 2026-08-05 09:18
VLAI
Title
wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the iwl_keyinfo.key field. Add a check to not copy more data to iwl_keyinfo.key then will fit. This fixes backtraces like this one: memcpy: detected field-spanning write (size 32) of single field "sta_cmd.key.key" at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (size 16) WARNING: CPU: 1 PID: 946 at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm] <snip> Hardware name: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017 RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm] <snip> Call Trace: <TASK> iwl_set_dynamic_key+0x1f0/0x220 [iwldvm] iwlagn_mac_set_key+0x1e4/0x280 [iwldvm] drv_set_key+0xa4/0x1b0 [mac80211] ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211] ieee80211_key_replace+0x22d/0x8e0 [mac80211] <snip>
Severity
7.6 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5 , < 76b5ea43ad2fb4f726ddfaff839430a706e7d7c2 (git)
Affected: 5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5 , < 3ed3c1c2fc3482b72e755820261779cd2e2c5a3e (git)
Affected: 5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5 , < fa57021262e998e2229d6383b1081638df2fe238 (git)
Affected: 5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5 , < 91ad1ab3cc7e981cb6d6ee100686baed64e1277e (git)
Affected: 5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5 , < 87940e4030e4705e1f3fd2bbb1854eae8308314b (git)
Affected: 5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5 , < 57189c885149825be8eb8c3524b5af017fdeb941 (git)
Affected: 5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5 , < 6cd644f66b43709816561d63e0173cb0c7aab159 (git)
Affected: 5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5 , < ef16799640865f937719f0771c93be5dca18adc6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.1
Unaffected: 0 , < 3.1 (semver)
Unaffected: 4.14.316 , ≤ 4.14.* (semver)
Unaffected: 4.19.284 , ≤ 4.19.* (semver)
Unaffected: 5.4.244 , ≤ 5.4.* (semver)
Unaffected: 5.10.181 , ≤ 5.10.* (semver)
Unaffected: 5.15.113 , ≤ 5.15.* (semver)
Unaffected: 6.1.30 , ≤ 6.1.* (semver)
Unaffected: 6.3.4 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/dvm/sta.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "76b5ea43ad2fb4f726ddfaff839430a706e7d7c2",
              "status": "affected",
              "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5",
              "versionType": "git"
            },
            {
              "lessThan": "3ed3c1c2fc3482b72e755820261779cd2e2c5a3e",
              "status": "affected",
              "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5",
              "versionType": "git"
            },
            {
              "lessThan": "fa57021262e998e2229d6383b1081638df2fe238",
              "status": "affected",
              "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5",
              "versionType": "git"
            },
            {
              "lessThan": "91ad1ab3cc7e981cb6d6ee100686baed64e1277e",
              "status": "affected",
              "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5",
              "versionType": "git"
            },
            {
              "lessThan": "87940e4030e4705e1f3fd2bbb1854eae8308314b",
              "status": "affected",
              "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5",
              "versionType": "git"
            },
            {
              "lessThan": "57189c885149825be8eb8c3524b5af017fdeb941",
              "status": "affected",
              "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5",
              "versionType": "git"
            },
            {
              "lessThan": "6cd644f66b43709816561d63e0173cb0c7aab159",
              "status": "affected",
              "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5",
              "versionType": "git"
            },
            {
              "lessThan": "ef16799640865f937719f0771c93be5dca18adc6",
              "status": "affected",
              "version": "5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/dvm/sta.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.316",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.284",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.244",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.316",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.284",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.244",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.181",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace\n\nA received TKIP key may be up to 32 bytes because it may contain\nMIC rx/tx keys too. These are not used by iwl and copying these\nover overflows the iwl_keyinfo.key field.\n\nAdd a check to not copy more data to iwl_keyinfo.key then will fit.\n\nThis fixes backtraces like this one:\n\n memcpy: detected field-spanning write (size 32) of single field \"sta_cmd.key.key\" at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (size 16)\n WARNING: CPU: 1 PID: 946 at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm]\n \u003csnip\u003e\n Hardware name: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017\n RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm]\n \u003csnip\u003e\n Call Trace:\n  \u003cTASK\u003e\n  iwl_set_dynamic_key+0x1f0/0x220 [iwldvm]\n  iwlagn_mac_set_key+0x1e4/0x280 [iwldvm]\n  drv_set_key+0xa4/0x1b0 [mac80211]\n  ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211]\n  ieee80211_key_replace+0x22d/0x8e0 [mac80211]\n \u003csnip\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is the 802.11 key-installation path of the iwlwifi dvm WiFi driver, reached when a TKIP key is programmed after association/4-way handshake with a wireless peer on the same WiFi segment. iwldvm supports AP, IBSS/RSN and STATION modes, so an adjacent wireless peer (rogue AP or associating station) drives whether the 32-byte TKIP cipher path is taken, making this Adjacent rather than Local.\nAC:L - The overflow is fully deterministic \u2014 mac80211 always passes keylen 32 for WLAN_CIPHER_SUITE_TKIP into a 16-byte field, so every TKIP key install triggers it with no race, timing window, or memory-layout dependency. TKIP is a standard supported cipher and CONFIG_FORTIFY_SOURCE is enabled by default in mainstream distro and Android kernels.\nPR:N - In AP/IBSS mode the key install is performed automatically by hostapd on behalf of an associating adjacent station, and in STA mode by wpa_supplicant when a TKIP-advertising AP is joined; in neither case does the attacker hold any privilege or account on the vulnerable host. Being a WLAN participant is not a privilege level on the target system.\nUI:N - When the affected host runs an AP or IBSS/RSN network with TKIP, an adjacent peer\u0027s association alone causes the per-station TKIP key to be programmed and the overflow to execute, with no action by any local user. No file must be opened, filesystem mounted, or connection manually initiated.\nS:U - The over-write stays within the on-stack struct iwl_addsta_cmd owned by the driver and the resulting fault or firmware command corruption is confined to the kernel\u0027s own security authority. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:L - There is no out-of-bounds read and no arbitrary memory disclosure, but the FORTIFY WARN backtrace exposes kernel text addresses, register state, and stack contents to the kernel log, and secret TKIP MIC key material is written into the tx_secur_seq_cnt field handed to device firmware, with a plausible TKIP TSC/IV-reuse path against link traffic. This is a limited, bounded exposure rather than arbitrary read.\nI:L - The write is a bounded 16-byte field-spanning overflow that provably cannot escape the 92-byte enclosing struct (fortify\u0027s p_size check confirms no struct-level overflow), so no return address, stack canary, or adjacent heap object can be corrupted and the content is not attacker-controlled. It does, however, corrupt the tx_secur_seq_cnt and hw_tkip_mic_rx_key fields programmed into the device, altering the link\u0027s TKIP sequence-counter state \u2014 a limited modification.\nA:H - The field-spanning write triggers a FORTIFY_SOURCE WARNING with full backtrace, which is an immediate kernel panic on the many hardened, Android, cloud, and CI kernels that set panic_on_warn=1. Additionally, the bogus TKIP TX sequence counter pushed to firmware can break the wireless link through peer replay-detection drops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:18:59.341Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/76b5ea43ad2fb4f726ddfaff839430a706e7d7c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ed3c1c2fc3482b72e755820261779cd2e2c5a3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa57021262e998e2229d6383b1081638df2fe238"
        },
        {
          "url": "https://git.kernel.org/stable/c/91ad1ab3cc7e981cb6d6ee100686baed64e1277e"
        },
        {
          "url": "https://git.kernel.org/stable/c/87940e4030e4705e1f3fd2bbb1854eae8308314b"
        },
        {
          "url": "https://git.kernel.org/stable/c/57189c885149825be8eb8c3524b5af017fdeb941"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cd644f66b43709816561d63e0173cb0c7aab159"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef16799640865f937719f0771c93be5dca18adc6"
        }
      ],
      "title": "wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54286",
    "datePublished": "2025-12-30T12:23:26.421Z",
    "dateReserved": "2025-12-30T12:06:44.526Z",
    "dateUpdated": "2026-08-05T09:18:59.341Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54286",
      "date": "2026-09-17",
      "epss": "0.00297",
      "percentile": "0.22459"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54286\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-30T13:16:17.620\",\"lastModified\":\"2026-08-04T11:16:39.357\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace\\n\\nA received TKIP key may be up to 32 bytes because it may contain\\nMIC rx/tx keys too. These are not used by iwl and copying these\\nover overflows the iwl_keyinfo.key field.\\n\\nAdd a check to not copy more data to iwl_keyinfo.key then will fit.\\n\\nThis fixes backtraces like this one:\\n\\n memcpy: detected field-spanning write (size 32) of single field \\\"sta_cmd.key.key\\\" at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (size 16)\\n WARNING: CPU: 1 PID: 946 at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm]\\n \u003csnip\u003e\\n Hardware name: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017\\n RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm]\\n \u003csnip\u003e\\n Call Trace:\\n  \u003cTASK\u003e\\n  iwl_set_dynamic_key+0x1f0/0x220 [iwldvm]\\n  iwlagn_mac_set_key+0x1e4/0x280 [iwldvm]\\n  drv_set_key+0xa4/0x1b0 [mac80211]\\n  ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211]\\n  ieee80211_key_replace+0x22d/0x8e0 [mac80211]\\n \u003csnip\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nwifi: iwlwifi: dvm: Correcci\u00f3n de memcpy: se detect\u00f3 un rastreo de pila de escritura que abarca campos\\n\\nUna clave TKIP recibida puede tener hasta 32 bytes porque tambi\u00e9n puede contener claves MIC rx/tx. Estas no son utilizadas por iwl y copiarlas desborda el campo iwl_keyinfo.key.\\n\\nA\u00f1adir una comprobaci\u00f3n para no copiar m\u00e1s datos a iwl_keyinfo.key de los que caben.\\n\\nEsto corrige rastreos de pila como este:\\n\\n memcpy: se detect\u00f3 una escritura que abarca campos (tama\u00f1o 32) de un solo campo \u0027sta_cmd.key.key\u0027 en drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (tama\u00f1o 16)\\n ADVERTENCIA: CPU: 1 PID: 946 en drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm]\\n \\n Nombre del hardware: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017\\n RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm]\\n \\n Rastreo de Llamadas:\\n  \\n  iwl_set_dynamic_key+0x1f0/0x220 [iwldvm]\\n  iwlagn_mac_set_key+0x1e4/0x280 [iwldvm]\\n  drv_set_key+0xa4/0x1b0 [mac80211]\\n  ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211]\\n  ieee80211_key_replace+0x22d/0x8e0 [mac80211]\\n \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/dvm/sta.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5\",\"lessThan\":\"76b5ea43ad2fb4f726ddfaff839430a706e7d7c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5\",\"lessThan\":\"3ed3c1c2fc3482b72e755820261779cd2e2c5a3e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5\",\"lessThan\":\"fa57021262e998e2229d6383b1081638df2fe238\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5\",\"lessThan\":\"91ad1ab3cc7e981cb6d6ee100686baed64e1277e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5\",\"lessThan\":\"87940e4030e4705e1f3fd2bbb1854eae8308314b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5\",\"lessThan\":\"57189c885149825be8eb8c3524b5af017fdeb941\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5\",\"lessThan\":\"6cd644f66b43709816561d63e0173cb0c7aab159\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a3d9882b84edf5fa8e8ca33a5d6df25e2e727a5\",\"lessThan\":\"ef16799640865f937719f0771c93be5dca18adc6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/dvm/sta.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.316\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.284\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.244\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.181\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.113\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.30\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.4\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3ed3c1c2fc3482b72e755820261779cd2e2c5a3e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/57189c885149825be8eb8c3524b5af017fdeb941\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6cd644f66b43709816561d63e0173cb0c7aab159\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/76b5ea43ad2fb4f726ddfaff839430a706e7d7c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/87940e4030e4705e1f3fd2bbb1854eae8308314b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/91ad1ab3cc7e981cb6d6ee100686baed64e1277e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ef16799640865f937719f0771c93be5dca18adc6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fa57021262e998e2229d6383b1081638df2fe238\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-04T12:26:42+00:00",
      "cve": "CVE-2023-54286",
      "id": "CVE-2023-54286",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_not_affected": "242",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54286.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:40:09Z",
      "cve": "CVE-2023-54286",
      "id": "CVE-2023-54286",
      "initial_release_date": "2025-12-31T00:26:40Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "372",
      "product_status:recommended": "309",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54286",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54286.json",
      "version": "30"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.