Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled. Add a check that the total IE length fits within the buffer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
bdcd81707973cf8aa9305337166f8ee842a050d4 to < 7cae33e3e09a080db96e3a8980c2c8d288318320affectedbdcd81707973cf8aa9305337166f8ee842a050d4 to < 1eeed9efc9a40e0635e910c37fee86543041b4e1affectedbdcd81707973cf8aa9305337166f8ee842a050d4 to < a38d7d6376b295245b53bc98b7ca682c027abaf7affectedbdcd81707973cf8aa9305337166f8ee842a050d4 to < 1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5eaffectedbdcd81707973cf8aa9305337166f8ee842a050d4 to < d70c0a850c21b57a6f46ce363860203389bbeaa6affectedbdcd81707973cf8aa9305337166f8ee842a050d4 to < 33b5342d2080657054ddf89ef1199b426a37dae8affectedbdcd81707973cf8aa9305337166f8ee842a050d4 to < 94e1bfcefe8264a207c2fda2febb954e70a34b42affectedbdcd81707973cf8aa9305337166f8ee842a050d4 to < 6b47b29730de3232b919d8362749f6814c5f2a33affected
Linux Linux
Default version status: affected
3.2affected0 to < 3.2unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/7cae33e3e09a080db96e3a8980c2c8d288318320 ↗
- https://git.kernel.org/stable/c/1eeed9efc9a40e0635e910c37fee86543041b4e1 ↗
- https://git.kernel.org/stable/c/a38d7d6376b295245b53bc98b7ca682c027abaf7 ↗
- https://git.kernel.org/stable/c/1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e ↗
- https://git.kernel.org/stable/c/d70c0a850c21b57a6f46ce363860203389bbeaa6 ↗
- https://git.kernel.org/stable/c/33b5342d2080657054ddf89ef1199b426a37dae8 ↗
- https://git.kernel.org/stable/c/94e1bfcefe8264a207c2fda2febb954e70a34b42 ↗
- https://git.kernel.org/stable/c/6b47b29730de3232b919d8362749f6814c5f2a33 ↗