linux-cve-announce - CVE-2023-53715: wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025102213-CVE-2023-53715-fd47@gregkh>
Date: Wed, 22 Oct 2025 15:24:54 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53715: wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex

Apparently the hex passphrase mechanism does not work on newer
chips/firmware (e.g. BCM4387). It seems there was a simple way of
passing it in binary all along, so use that and avoid the hexification.

OpenBSD has been doing it like this from the beginning, so this should
work on all chips.

Also clear the structure before setting the PMK. This was leaking
uninitialized stack contents to the device.

The Linux kernel CVE team has assigned CVE-2023-53715 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.14.316 with commit 1687845eb8f37360a9ee849a3587ab659b090773
	Fixed in 4.19.284 with commit 2bc34facb90ceeff6f8c17d2006575a6d07c3825
	Fixed in 5.4.244 with commit 56c7e9c39bd54fd753c0c4b1ed10278cbd3a5f02
	Fixed in 5.10.181 with commit 4e8dc0e5c7636efaadbd7e488acd34b4291c0431
	Fixed in 5.15.113 with commit e242c66f7ecfe8f5b6eb308f4ea464fd8589c866
	Fixed in 6.1.30 with commit f8a6c53ff1d91acd5a20eb627edbffd816eb9a4e
	Fixed in 6.3.4 with commit 2fa3a5226b05e0a797c68b9609dcebe0cd236b27
	Fixed in 6.4 with commit 89b89e52153fda2733562776c7c9d9d3ebf8dd6d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53715
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1687845eb8f37360a9ee849a3587ab659b090773
	https://git.kernel.org/stable/c/2bc34facb90ceeff6f8c17d2006575a6d07c3825
	https://git.kernel.org/stable/c/56c7e9c39bd54fd753c0c4b1ed10278cbd3a5f02
	https://git.kernel.org/stable/c/4e8dc0e5c7636efaadbd7e488acd34b4291c0431
	https://git.kernel.org/stable/c/e242c66f7ecfe8f5b6eb308f4ea464fd8589c866
	https://git.kernel.org/stable/c/f8a6c53ff1d91acd5a20eb627edbffd816eb9a4e
	https://git.kernel.org/stable/c/2fa3a5226b05e0a797c68b9609dcebe0cd236b27
	https://git.kernel.org/stable/c/89b89e52153fda2733562776c7c9d9d3ebf8dd6d