Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing The Extended Supported Rates (ESR) IE handling in OnBeacon accessed *(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these offsets lie within the received frame buffer. A malformed beacon with an ESR IE positioned at the end of the buffer could cause an out-of-bounds read, potentially triggering a kernel panic. Add a boundary check to ensure that the ESR IE body and the subsequent bytes are within the limits of the frame before attempting to access them. This prevents OOB reads caused by malformed beacon frames.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
554c0a3abf216c991c5ebddcdb2c08689ecd290b to < c03cb111628924827351e19baa5b073e9b0d723daffected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < bb5940193d813449540d8d3a82abc045be41f48aaffected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < c173ce97d3f0f0c0fefa39139d6d04ba60b5db22affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < d1ab7f9cee22e7b8a528da9ac953e4193b96cda5affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 38292407c2bb5b2b3131aaace4ecc7a829b40b76affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < bf323db1d883c209880bd92f3b12503e3531c3fcaffected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 502ddcc405b69fa92e0add6c1714d654504f6fd7affected
Linux Linux
Default version status: affected
4.12affected0 to < 4.12unaffected5.15.198 to ≤ 5.15.*unaffected6.1.160 to ≤ 6.1.*unaffected6.6.120 to ≤ 6.6.*unaffected6.12.62 to ≤ 6.12.*unaffected6.17.12 to ≤ 6.17.*unaffected6.18.1 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c03cb111628924827351e19baa5b073e9b0d723d ↗
- https://git.kernel.org/stable/c/bb5940193d813449540d8d3a82abc045be41f48a ↗
- https://git.kernel.org/stable/c/c173ce97d3f0f0c0fefa39139d6d04ba60b5db22 ↗
- https://git.kernel.org/stable/c/d1ab7f9cee22e7b8a528da9ac953e4193b96cda5 ↗
- https://git.kernel.org/stable/c/38292407c2bb5b2b3131aaace4ecc7a829b40b76 ↗
- https://git.kernel.org/stable/c/bf323db1d883c209880bd92f3b12503e3531c3fc ↗
- https://git.kernel.org/stable/c/502ddcc405b69fa92e0add6c1714d654504f6fd7 ↗