In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
rtw_restruct_wmm_ie() scans in_ie for a WMM IE with:
<pre>
while (i < in_len) {
...
if (i + 5 < in_len && in_ie[i] == 0xDD && ...) {
...
break;
}
i += (in_ie[i + 1] + 2); /* to the next IE element */
}
</pre>
When the "i + 5 < in_len" match check fails simply because i is
within 5 bytes of the end of the buffer (i.e. no WMM IE was found
near the tail of in_ie), execution falls through to
"i += (in_ie[i + 1] + 2)", which reads in_ie[i + 1]. If i == in_len
- 1 at that point, this is a 1-byte out-of-bounds read of an
attacker-influenced IE buffer built from association/scan data.
Commit a75281626fc8f ("staging: rtl8723bs: fix potential
out-of-bounds read in rtw_restruct_wmm_ie") added the "i + 5 <
in_len" guard to the match condition itself, but did not add an
equivalent guard before the fallthrough advance, so the same class
of OOB read remained reachable through the non-matching path.
Add an explicit bounds check before advancing to the next IE.
CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS Score: 7.1
AV:A - rtw_restruct_wmm_ie() walks WMM IEs from scanned BSS candidates filled by collect_bss_info() from over-the-air beacon and probe-response frames (OnBeacon/OnProbeRsp). The attacker must be in WiFi radio range; kernel guidance maps WiFi frame injection to Adjacent.
AC:L - The attacker fully controls beacon/probe IE layout and can place a truncated tail IE so the walker lands at in_len-1, making the unguarded in_ie[i+1] read deterministic. wmm_enable defaults to 1, and no race or attacker-uncontrollable memory layout is required.
PR:N - Scan and join/roam consume attacker beacon IEs before any authentication with the rogue BSS. No local account, capability, or user-namespace privilege is required.
UI:N - RTW_ROAM_ON_EXPIRED is enabled by default, so association expiry or an attacker-driven reconnect automatically calls rtw_select_and_join_from_scanned_queue() without a new victim click. An evil-twin BSS matching the desired SSID is selected by RSSI during normal WiFi operation.
S:U - The out-of-bounds read and any resulting kernel impact remain inside the rtl8723bs driver on the host. This is not a VM escape, IOMMU bypass, or other cross-authority boundary crossing.
C:L - The fallthrough path reads exactly one byte past the declared IE length (in_ie[i+1] when i==in_len-1). Kernel guidance scores a strictly bounded few-byte out-of-bounds read as Low confidentiality rather than an arbitrary-read primitive.
I:N - The bug only reads in_ie[i+1] to compute the next IE offset and then exits the loop. It does not write out of bounds or provide a data-modification or control-flow hijack primitive.
A:H - An out-of-bounds kernel read can oops or panic on hardened, KASAN, or redzone kernels, and an adjacent attacker can retrigger the join/roam path with further crafted management frames to deny availability.
| Attack Vector |
Adjacent Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
Low |
| Privileges Required |
None |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:A - rtw_restruct_wmm_ie() walks WMM IEs from scanned BSS candidates filled by collect_bss_info() from over-the-air beacon and probe-response frames (OnBeacon/OnProbeRsp). The attacker must be in WiFi radio range; kernel guidance maps WiFi frame injection to Adjacent.
AC:L - The attacker fully controls beacon/probe IE layout and can place a truncated tail IE so the walker lands at in_len-1, making the unguarded in_ie[i+1] read deterministic. wmm_enable defaults to 1, and no race or attacker-uncontrollable memory layout is required.
PR:N - Scan and join/roam consume attacker beacon IEs before any authentication with the rogue BSS. No local account, capability, or user-namespace privilege is required.
UI:N - RTW_ROAM_ON_EXPIRED is enabled by default, so association expiry or an attacker-driven reconnect automatically calls rtw_select_and_join_from_scanned_queue() without a new victim click. An evil-twin BSS matching the desired SSID is selected by RSSI during normal WiFi operation.
S:U - The out-of-bounds read and any resulting kernel impact remain inside the rtl8723bs driver on the host. This is not a VM escape, IOMMU bypass, or other cross-authority boundary crossing.
C:L - The fallthrough path reads exactly one byte past the declared IE length (in_ie[i+1] when i==in_len-1). Kernel guidance scores a strictly bounded few-byte out-of-bounds read as Low confidentiality rather than an arbitrary-read primitive.
I:N - The bug only reads in_ie[i+1] to compute the next IE offset and then exits the loop. It does not write out of bounds or provide a data-modification or control-flow hijack primitive.
A:H - An out-of-bounds kernel read can oops or panic on hardened, KASAN, or redzone kernels, and an adjacent attacker can retrigger the join/roam path with further crafted management frames to deny availability.
CVSS 3.1