Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() rtw_get_wps_ie() iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - in_ie[cnt + 1] is read without checking cnt + 1 < in_len - memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check - in_ie[cnt + 1] is used as length without verifying payload fits Add bounds checks at the top of the loop body to break early if fewer than 2 bytes remain for the IE header, or if the declared payload extends past the end of the buffer. Also require at least 4 bytes of payload before comparing the WPS OUI.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
554c0a3abf216c991c5ebddcdb2c08689ecd290b to < c670efe69ec8a3360bfa596436f0250a3bf15d42affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 23b630e334f7e8f76bb22a18aca350da995af905affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < b9d9a4cd2e59df7281992a076464d2536e80c674affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 630fdca3f2437fee3ffd437c4b646ccf84c7be87affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 875479f18835ac11e21a83e88f3d4dc7ccdcd0c4affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 23c31f107b4f8f420a754a45d12599bdb78f9bb8affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 0e95ff792ae0aa6fbad9455943e9e1e4062670e9affected
Linux Linux
Default version status: affected
4.12affected0 to < 4.12unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c670efe69ec8a3360bfa596436f0250a3bf15d42 ↗
- https://git.kernel.org/stable/c/23b630e334f7e8f76bb22a18aca350da995af905 ↗
- https://git.kernel.org/stable/c/b9d9a4cd2e59df7281992a076464d2536e80c674 ↗
- https://git.kernel.org/stable/c/630fdca3f2437fee3ffd437c4b646ccf84c7be87 ↗
- https://git.kernel.org/stable/c/875479f18835ac11e21a83e88f3d4dc7ccdcd0c4 ↗
- https://git.kernel.org/stable/c/23c31f107b4f8f420a754a45d12599bdb78f9bb8 ↗
- https://git.kernel.org/stable/c/0e95ff792ae0aa6fbad9455943e9e1e4062670e9 ↗