Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
16be1ac55944412e8d132b1db26f994b368c5742 to < 04aba50212f9f274e1a726fb3873b5ce8da2d821affected16be1ac55944412e8d132b1db26f994b368c5742 to < c07aa0534d50361183833e3803204044cf1d0476affected16be1ac55944412e8d132b1db26f994b368c5742 to < d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35affected16be1ac55944412e8d132b1db26f994b368c5742 to < af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597eeaffected16be1ac55944412e8d132b1db26f994b368c5742 to < d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2affected16be1ac55944412e8d132b1db26f994b368c5742 to < b5e6f21923ca89d90256e7346301056f6502691eaffected
Linux Linux
Default version status: affected
4.7affected0 to < 4.7unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/04aba50212f9f274e1a726fb3873b5ce8da2d821 ↗
- https://git.kernel.org/stable/c/c07aa0534d50361183833e3803204044cf1d0476 ↗
- https://git.kernel.org/stable/c/d0b57bcd0dac6e2c9a3e474ec280e7db0b3edf35 ↗
- https://git.kernel.org/stable/c/af8f0ea1f0a3a5fb5ed2b8fed3f1501d644597ee ↗
- https://git.kernel.org/stable/c/d0cafe6ed8d1f6d0097eda31d85f5760d4f359c2 ↗
- https://git.kernel.org/stable/c/b5e6f21923ca89d90256e7346301056f6502691e ↗