[PATCH v4 0/5] staging: rtl8723bs: fix multiple security vulnerabilities

Delene Tchio Romuald
2026-04-15T18:55:30Z

This series fixes five remotely-triggerable memory safety issues in
the rtl8723bs driver. All of them are reachable from the air by an
attacker within WiFi radio range, without authentication, via
crafted management or data frames:

1. Heap buffer overflow in recvframe_defrag() when reassembling
fragmented frames whose total payload exceeds the receive
buffer capacity.
2. Integer underflow in TKIP MIC verification when a frame is
shorter than the sum of header, IV, ICV and MIC sizes.
3. Out-of-bounds read in portctrl() when a non-EAPOL frame is
shorter than the 802.11 header + IV + LLC + ether_type.
4. Out-of-bounds reads in three IE walkers (rtw_get_wapi_ie(),
rtw_get_sec_ie(), rtw_get_wps_ie()) due to missing validation
of the TLV length byte.
5. Integer underflow in rtw_wep_decrypt() when a WEP frame is
shorter than the header + IV.

Each patch was found by code review and is not tested on hardware.

Changes since v3:
- Patch 1/5 (recvframe_defrag): check the return values of
recvframe_pull() and recvframe_pull_tail(); on failure those
helpers revert their pointer updates and return NULL, so the
subsequent rx_end - rx_tail bounds check must not run on stale
pointers (Dan Carpenter).
- Patch 1/5: drop the unnecessary (uint) cast in the bounds
check (Dan Carpenter).
- All patches: add Fixes: tag pointing at the driver import and
add the stable backport tag, per Dan Carpenter's request.
- Patches 2-5: carry Reviewed-by: Luka Gejak. Patch 1/5 lost
Luka's tag because the code changed.

Changes since v2:
- Sent as numbered series with cover letter.
- Cc list regenerated from scripts/get_maintainer.pl.

Changes since v1:
- Rebased on staging-next (v1 was based on v7.0-rc6 and did not
apply).

Delene Tchio Romuald (5):
staging: rtl8723bs: fix heap buffer overflow in recvframe_defrag()
staging: rtl8723bs: fix integer underflow in TKIP MIC verification
staging: rtl8723bs: fix out-of-bounds read in portctrl()
staging: rtl8723bs: fix out-of-bounds reads in IE parsing functions
staging: rtl8723bs: fix negative length in WEP decryption

.../staging/rtl8723bs/core/rtw_ieee80211.c | 15 ++++-
drivers/staging/rtl8723bs/core/rtw_recv.c | 55 ++++++++++++++-----
drivers/staging/rtl8723bs/core/rtw_security.c | 6 ++
3 files changed, 60 insertions(+), 16 deletions(-)

base-commit: bf9c95f3eeefb7fc4b4a6380cc23f1dca744e379
--
2.43.0