From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3DB8043E9CB; Mon, 17 Aug 2026 14:57:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786978646; cv=none; b=GRiIATxygzzt6qxRXK5x+bFnOKDAurvQxrcd61UOngifCBNjDYXxxOwfXtVetufa8vsreFOAZQG/jc7Qa6msv2Wusmzpw7I1so8Q0wKHukQfaklpGuyPr+/FEhZ0UiNUv2hD29lmkgx8O7HdH6STQhOKOYTLmUzFWUov0ITPn+o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786978646; c=relaxed/simple; bh=OcXCAsn/G9xQL8T3595Hunv3cuWuwa8Ayo2zNz1G02M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=I0hAYdatVps5bxBAC6i/Pfc30X1cBXXb+sRq0rUDUBjdrJ6TmYL9vaJ6EDybn7dUk/U/Y8cM/18C4lWv3DDlhcCi4NfTdAB0Z67g7RFFY155+GuAPUjgbTL1mrqxrtL6IG+wjxHvfHrnmZumApzkSggYghHNUfQ/FS9xWUO1WQk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=U5berADt; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="U5berADt" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 857211F000E9; Mon, 17 Aug 2026 14:57:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786978645; bh=JU5rMW/2AdxWQHuvGsrfbb+GnvwNYj+HJP+JU42FURw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=U5berADttjQA9cdkRmDALg7a2u9kCvPa9Q7MWpyFKexGrejbuGueIEJYUEPQQ9j4d zfeLTrLahvHdB7Vh4ROBHi6EIEdZnpF3Hk2kZZRxWIFLtJneWLPmwOsNIHalkkR6q6 41cSutL2twCZBnNyqFo4aPYGgfNYtHpCUv5sJw1Y= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Panagiotis Petrakopoulos Subject: [PATCH 6.6 107/156] staging: rtl8723bs: fix missing shared-key auth challenge length check Date: Mon, 17 Aug 2026 15:34:01 +0200 Message-ID: <20260817132538.806497774@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132534.666299318@linuxfoundation.org> References: <20260817132534.666299318@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Panagiotis Petrakopoulos commit 2c56ef658ac8c6bca36bc5574715e8f717207c6c upstream. The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer. In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication. In the case of an overflow, the driver can write out of bounds. In the case of an underfill, the driver can echo stale buffer memory. The challenge text is defined to be exactly 128 octets, which is already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the element to be exactly that length before use. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable Signed-off-by: Panagiotis Petrakopoulos Link: https://patch.msgid.link/20260720082409.168379-1-npetrakopoulos2003@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c @@ -905,7 +905,7 @@ unsigned int OnAuthClient(struct adapter p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&len, pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_); - if (!p) + if (!p || len != WLAN_AUTH_CHALLENGE_LEN) goto authclnt_fail; memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);