In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
rtw_action_frame_parse() takes a frame_len parameter but never
actually checks it before indexing into the frame body:
<pre>
const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);
...
c = frame_body[0];
...
a = frame_body[1];
</pre>
frame_body already points 24 bytes (sizeof(struct
ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and
frame_body[1] requires frame_len >= 26. A management action frame
shorter than that (e.g. exactly 24 bytes, the minimum a malicious
peer can send) causes a 1-2 byte out-of-bounds read.
This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and
cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass
attacker/user-influenced frame buffers and lengths straight through.
Add the missing length check before frame_body is dereferenced.
CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS Score: 7.1
AV:A - rtw_action_frame_parse() is reached from rtw_cfg80211_rx_action() on received 802.11 public action frames (OnAction → on_action_public → on_action_public_default). A nearby attacker can inject a truncated management action frame over Wi-Fi; kernel CNA guidance maps Wi-Fi frame injection to Adjacent.
AC:L - An adjacent attacker fully controls the action-frame length and 802.11 header. A 24- or 25-byte management action frame (header only, or header plus category) reliably hits the missing length check with no race or attacker-uncontrollable layout.
PR:N - Public action frames are dispatched by mgt_dispatcher()/OnAction() with only a local-MAC match and no association or 802.11 authentication against the sender, so no local account or capability is required.
UI:N - The rtl8723bs driver processes received management action frames automatically while the interface is up; no extra victim click, mount, or connect action is required at exploit time.
S:U - The out-of-bounds read occurs in the host rtl8723bs driver and does not cross a VM, IOMMU, or other security-authority boundary.
C:L - The flaw reads only one or two bytes past a truncated 24- or 25-byte action frame. Per kernel CNA guidance this is a strictly bounded out-of-bounds read, not an arbitrary read primitive.
I:N - The bug is a read-only out-of-bounds access of the category/action bytes; those values are not used to write kernel memory or hijack control flow.
A:H - A 1-2 byte kernel out-of-bounds read can oops or panic on KASAN, redzone, or hardened kernels, and an adjacent peer can repeat truncated action frames to deny availability.
| Attack Vector |
Adjacent Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
Low |
| Privileges Required |
None |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:A - rtw_action_frame_parse() is reached from rtw_cfg80211_rx_action() on received 802.11 public action frames (OnAction → on_action_public → on_action_public_default). A nearby attacker can inject a truncated management action frame over Wi-Fi; kernel CNA guidance maps Wi-Fi frame injection to Adjacent.
AC:L - An adjacent attacker fully controls the action-frame length and 802.11 header. A 24- or 25-byte management action frame (header only, or header plus category) reliably hits the missing length check with no race or attacker-uncontrollable layout.
PR:N - Public action frames are dispatched by mgt_dispatcher()/OnAction() with only a local-MAC match and no association or 802.11 authentication against the sender, so no local account or capability is required.
UI:N - The rtl8723bs driver processes received management action frames automatically while the interface is up; no extra victim click, mount, or connect action is required at exploit time.
S:U - The out-of-bounds read occurs in the host rtl8723bs driver and does not cross a VM, IOMMU, or other security-authority boundary.
C:L - The flaw reads only one or two bytes past a truncated 24- or 25-byte action frame. Per kernel CNA guidance this is a strictly bounded out-of-bounds read, not an arbitrary read primitive.
I:N - The bug is a read-only out-of-bounds access of the category/action bytes; those values are not used to write kernel memory or hijack control flow.
A:H - A 1-2 byte kernel out-of-bounds read can oops or panic on KASAN, redzone, or hardened kernels, and an adjacent peer can repeat truncated action frames to deny availability.
CVSS 3.1