Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() rtw_restruct_wmm_ie() scans in_ie for a WMM IE with: while (i < in_len) { ... if (i + 5 < in_len && in_ie[i] == 0xDD && ...) { ... break; } i += (in_ie[i + 1] + 2); /* to the next IE element */ } When the "i + 5 < in_len" match check fails simply because i is within 5 bytes of the end of the buffer (i.e. no WMM IE was found near the tail of in_ie), execution falls through to "i += (in_ie[i + 1] + 2)", which reads in_ie[i + 1]. If i == in_len - 1 at that point, this is a 1-byte out-of-bounds read of an attacker-influenced IE buffer built from association/scan data. Commit a75281626fc8f ("staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie") added the "i + 5 < in_len" guard to the match condition itself, but did not add an equivalent guard before the fallthrough advance, so the same class of OOB read remained reachable through the non-matching path. Add an explicit bounds check before advancing to the next IE.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 0c1f8bada613edbd810d010996d36159092576d5affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 55034fa38bd8b302ceb32c15e8a98298f56f629baffected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < a8d76480d1abbbf617c2d6d9f60bf95ab45cff04affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 716850842d2f103f915fe7c857ff1a0a036491b4affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < e63b72c5d7336981dfc05e5cb92becff29dfea00affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 4420cc71841b50e31a7868ef7acb011c0e08d294affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < fd19b8895f8a91087e8a62f1e27b128025dabb95affected554c0a3abf216c991c5ebddcdb2c08689ecd290b to < 28a289beaf226b30b1e6e7d7b1a2946fe2d6e852affected
Linux Linux
Default version status: affected
4.12affected0 to < 4.12unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0c1f8bada613edbd810d010996d36159092576d5 ↗
- https://git.kernel.org/stable/c/55034fa38bd8b302ceb32c15e8a98298f56f629b ↗
- https://git.kernel.org/stable/c/a8d76480d1abbbf617c2d6d9f60bf95ab45cff04 ↗
- https://git.kernel.org/stable/c/716850842d2f103f915fe7c857ff1a0a036491b4 ↗
- https://git.kernel.org/stable/c/e63b72c5d7336981dfc05e5cb92becff29dfea00 ↗
- https://git.kernel.org/stable/c/4420cc71841b50e31a7868ef7acb011c0e08d294 ↗
- https://git.kernel.org/stable/c/fd19b8895f8a91087e8a62f1e27b128025dabb95 ↗
- https://git.kernel.org/stable/c/28a289beaf226b30b1e6e7d7b1a2946fe2d6e852 ↗