Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two IE parsing loops are missing the header bounds checks before they dereference pIE->length: - issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and no length byte, pIE->length is read one byte past the end of the buffer. - join_cmd_hdl() walks pnetwork->ies during station join and has the same problem under the same conditions. Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue. Apply the two-guard pattern established in update_beacon_info(): 1. Break if fewer than sizeof(*pIE) bytes remain. 2. Break if the IE's declared data extends past the buffer end.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
554c0a3abf216c991c5ebddcdb2c08689ecd290b to < bc881c9915c4468747d0ca5fd1abd7b313cfb0f4affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 605ebd94d0f469204f3c9f2f84acc71e43e2780faffected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < a830bdc82461353bf7b1f8a2ad2689bf5d2de444affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 4c21eec80cf502d9ea18e0b946246b2376452786affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < ad2637c46ef8b8ae0894372a2d39fdfcdc420a1eaffected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < c38d16b1ffac385c9e4b38447cd5c46af1114b58affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 402f13ec95945f34a210b28df1f8740d3d4a58c5affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < ef61d628dfad38fead1fd2e08979ae9126d011d5affected
Linux Linux
Default version status: affected
4.12affected0 to < 4.12unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.96 to ≤ 6.12.*unaffected6.18.39 to ≤ 6.18.*unaffected7.1.4 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/bc881c9915c4468747d0ca5fd1abd7b313cfb0f4 ↗
- https://git.kernel.org/stable/c/605ebd94d0f469204f3c9f2f84acc71e43e2780f ↗
- https://git.kernel.org/stable/c/a830bdc82461353bf7b1f8a2ad2689bf5d2de444 ↗
- https://git.kernel.org/stable/c/4c21eec80cf502d9ea18e0b946246b2376452786 ↗
- https://git.kernel.org/stable/c/ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e ↗
- https://git.kernel.org/stable/c/c38d16b1ffac385c9e4b38447cd5c46af1114b58 ↗
- https://git.kernel.org/stable/c/402f13ec95945f34a210b28df1f8740d3d4a58c5 ↗
- https://git.kernel.org/stable/c/ef61d628dfad38fead1fd2e08979ae9126d011d5 ↗