In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()<\/p>\n
wilc_wlan_handle_isr_ext() takes the RX transfer size from the
\ndevice-reported interrupt status register (a 15-bit field shifted left by 2,
\nup to 131068 bytes) and reads that many bytes from the device into
\nrx_buffer, which is only WILC_RX_BUFF_SIZE (96K) large. The wrap
\ncheck only handles the current offset; the size itself is never
\ncompared against the buffer, so a bogus SDIO device can make the driver
\nOOB-write rx_buffer by up to ~32K with data it controls.<\/p>\n
The oversized transfer also leaves rx_buffer_offset past the end of
\nthe buffer, after which the unsigned wrap check stops working and
\nthe overflow can repeat.<\/p>\n
Drop any transfer whose size exceeds the RX buffer, acknowledging
\nthe data interrupt and re-arming the RX engine so the bogus frame is
\ndiscarded and reception can continue. This also restores the
\nrx_buffer_offset <= WILC_RX_BUFF_SIZE invariant the wrap check
\nrelies on.<\/p>\n
This is not expected to change driver behavior in most cases:
\nwithout this check, an oversized transfer would most likely
\ncorrupt neighboring kernel memory instead of completing anyway, and
\nthe drop path performs the same interrupt acknowledgment and RX
\nengine re-arming as the normal path, so subsequent transfers are
\nreceived unaffected.<\/p>\n
Discovered by Atuin – Automated Vulnerability Discovery Engine.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()<\/p>\n
wilc_wlan_handle_isr_ext() takes the RX transfer size from t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33258","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33258","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33258"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33258"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33258"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}