[PATCH v3 4/5] staging: rtl8723bs: fix out-of-bounds reads in IE parsing functions

Delene Tchio Romuald
2026-04-05T10:17:41Z

The IE parsing loops in rtw_get_wapi_ie(), rtw_get_sec_ie(), and
rtw_get_wps_ie() check only that the element ID byte is within bounds
(cnt < in_len), but then immediately access the length byte at
in_ie[cnt+1] and data bytes at in_ie[cnt+2] and beyond without
verifying that these offsets are within the buffer.

A malicious access point can send beacon or probe response frames with
truncated Information Elements, triggering out-of-bounds reads on
kernel heap memory. No authentication is required.

Add two bounds checks to each function:
- Ensure at least 2 bytes remain for the IE header (cnt + 1 < in_len)
- Validate the full IE fits in the buffer before accessing its data
(cnt + 2 + ie_len <= in_len)

Found by reviewing memory operations in the driver.
Not tested on hardware.

Signed-off-by: Delene Tchio Romuald <delenetchior1@gmail.com>
---
v3:
- Rebased on staging-next
- Sent as numbered series with proper Cc from get_maintainer.pl
v2:
- Rebased on staging-next (v1 did not apply due to code reformatting)

drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
index 72b7f731dd471..e0fed3f42de0c 100644
--- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
@@ -582,9 +582,12 @@ int rtw_get_wapi_ie(u8 *in_ie, uint in_len, u8 *wapi_ie, u16 *wapi_len)

cnt = (_TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_);

- while (cnt < in_len) {
+ while (cnt + 1 < in_len) {
authmode = in_ie[cnt];

+ if (cnt + 2 + in_ie[cnt + 1] > in_len)
+ break;
+
if (authmode == WLAN_EID_BSS_AC_ACCESS_DELAY &&
(!memcmp(&in_ie[cnt + 6], wapi_oui1, 4) ||
!memcmp(&in_ie[cnt + 6], wapi_oui2, 4))) {
@@ -615,9 +618,12 @@ void rtw_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len, u8 *wpa_ie

cnt = (_TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_);

- while (cnt < in_len) {
+ while (cnt + 1 < in_len) {
authmode = in_ie[cnt];

+ if (cnt + 2 + in_ie[cnt + 1] > in_len)
+ break;
+
if ((authmode == WLAN_EID_VENDOR_SPECIFIC) &&
(!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) {
if (wpa_ie)
@@ -658,9 +664,12 @@ u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)

cnt = 0;

- while (cnt < in_len) {
+ while (cnt + 1 < in_len) {
eid = in_ie[cnt];

+ if (cnt + 2 + in_ie[cnt + 1] > in_len)
+ break;
+
if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) {
wpsie_ptr = &in_ie[cnt];

--
2.43.0