In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each
iteration but only guards on i < pkt_len. When a malicious AP sends an
AssocResponse whose last IE has only one byte remaining in the frame
(the element_id byte lands at pkt_len-1), the loop reads pIE->length
from pframe[pkt_len], which is one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond pkt_len, silently passing a
truncated IE to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past pkt_len.
CVSS
8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 889ca6000ac7fa73457b041848fcb08e0d51b809; 554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 1a52a05471494546f955a58e8c170c0c796c52d5; 554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 0406d746574e875d8778552eb674fcfbf5330bfb; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 0970dd47726a57e52013594e9fbf667586eb3673; 554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 04f612dc03427e0b1ac80a2611b5ac0ba93ac446; 554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 7e7741c8315e4160aead00a60cdd6f81ab880717; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before f9654207e92283e0acac5d64fe5f8835383b5a23
from 4.12 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4; 7.2; 7.2
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
