In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()<\/p>\n
rtw_restruct_wmm_ie() scans in_ie for a WMM IE with:<\/p>\n
\twhile (i < in_len) {
\n\t\t…
\n\t\tif (i + 5 < in_len && in_ie[i] == 0xDD && …) {
\n\t\t\t…
\n\t\t\tbreak;
\n\t\t}
\n\t\ti += (in_ie[i + 1] + 2); \/* to the next IE element *\/
\n\t}<\/p>\n
When the "i + 5 < in_len" match check fails simply because i is
\nwithin 5 bytes of the end of the buffer (i.e. no WMM IE was found
\nnear the tail of in_ie), execution falls through to
\n"i += (in_ie[i + 1] + 2)", which reads in_ie[i + 1]. If i == in_len
\n– 1 at that point, this is a 1-byte out-of-bounds read of an
\nattacker-influenced IE buffer built from association\/scan data.<\/p>\n
Commit a75281626fc8f ("staging: rtl8723bs: fix potential
\nout-of-bounds read in rtw_restruct_wmm_ie") added the "i + 5 <
\nin_len" guard to the match condition itself, but did not add an
\nequivalent guard before the fallthrough advance, so the same class
\nof OOB read remained reachable through the non-matching path.<\/p>\n
Add an explicit bounds check before advancing to the next IE.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()<\/p>\n
rtw_restruct_wmm_ie() scans in_ie for a WMM IE with:<\/p>\n
\twhile (i < in_len<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24704","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24704","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24704"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24704"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24704"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}