In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()<\/p>\n
rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific
\ninformation element without checking that the element is long enough,
\ncausing an out-of-bounds read for a short trailing IE.<\/p>\n
The function locates a vendor-specific IE (EID 221) with rtw_get_ie()
\nand then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte
\nversion word at pbuf + 6. Those accesses require the IE body to be at
\nleast 6 bytes, but rtw_get_ie() only guarantees that the element fits
\nwithin the buffer; it does not enforce a minimum body length. A
\nvendor-specific IE whose length byte is 0 to 5, placed at the end of
\nthe buffer, therefore makes these reads run past the end of the IE and
\npast the end of the buffer itself.<\/p>\n
The buffer holds information elements taken from received management
\nframes and from the IE blob passed to rtw_cfg80211_set_wpa_ie(), which
\nis kmemdup’d to its exact length, so the read can run off the end of
\nthe allocation.<\/p>\n
The sibling helpers rtw_get_sec_ie(), rtw_get_wapi_ie() and
\nrtw_get_wps_ie() in this file already reject too-short vendor-specific
\nIEs before their OUI memcmp(); rtw_get_wpa_ie() was never brought in
\nline with them, and needs a minimum of 6 rather than 4 bytes because
\nof the version word. Add the missing length check.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()<\/p>\n
rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific
\ninformat<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11243","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}