staging: rtl8723bs: OOB write in HT_caps_handler() via attacker-controlled IE length

staging: rtl8723bs: OOB write in HT_caps_handler() via attacker-controlled IE length

[Alexandru Hossu]

Hi,

I found an out-of-bounds write in HT_caps_handler() in
drivers/staging/rtl8723bs/core/rtw_wlan_util.c.

At line 938-942:

    for (i = 0; i < (pIE->length); i++) {
        if (i != 2) {
            pmlmeinfo->HT_caps.u.HT_cap[i] &= (pIE->data[i]);

HT_cap[] is 26 bytes (wifi.h:349). pIE->length comes from the
WLAN_EID_HT_CAPABILITY IE in an association response and can be up to 255.
The loop writes up to 229 bytes past the end of the array.

A rogue access point triggers this by sending an HT Capability IE with
length > 26 in the association response. No authentication is needed.

The write is AND-only so it can only clear bits in adjacent struct fields
(HT_info, wlan_bssid_ex). This causes state corruption and can crash the
driver. The RTL8723BS chip is in a large number of cheap laptops and IoT
devices.

Suggested fix:

    u8 ht_cap_len = min_t(u8, pIE->length,
                          sizeof(pmlmeinfo->HT_caps.u.HT_cap));
    for (i = 0; i < ht_cap_len; i++) {

Tested on linux-next commit e98d21c170b0 (2026-05-08).

Alexandru

Re: staging: rtl8723bs: OOB write in HT_caps_handler() via attacker-controlled IE length

[Greg KH]

On Fri, May 15, 2026 at 03:29:21AM -0700, Alexandru Hossu wrote:
> Hi,
> 
> I found an out-of-bounds write in HT_caps_handler() in
> drivers/staging/rtl8723bs/core/rtw_wlan_util.c.
> 
> At line 938-942:
> 
>     for (i = 0; i < (pIE->length); i++) {
>         if (i != 2) {
>             pmlmeinfo->HT_caps.u.HT_cap[i] &= (pIE->data[i]);
> 
> HT_cap[] is 26 bytes (wifi.h:349). pIE->length comes from the
> WLAN_EID_HT_CAPABILITY IE in an association response and can be up to 255.
> The loop writes up to 229 bytes past the end of the array.
> 
> A rogue access point triggers this by sending an HT Capability IE with
> length > 26 in the association response. No authentication is needed.
> 
> The write is AND-only so it can only clear bits in adjacent struct fields
> (HT_info, wlan_bssid_ex). This causes state corruption and can crash the
> driver. The RTL8723BS chip is in a large number of cheap laptops and IoT
> devices.
> 
> Suggested fix:
> 
>     u8 ht_cap_len = min_t(u8, pIE->length,
>                           sizeof(pmlmeinfo->HT_caps.u.HT_cap));
>     for (i = 0; i < ht_cap_len; i++) {
> 
> Tested on linux-next commit e98d21c170b0 (2026-05-08).
> 
> Alexandru

Great, please send a fix!

thanks,

greg k-h