Re: [PATCH v4 5/5] staging: rtl8723bs: fix negative length in WEP decryption

Dan Carpenter
2026-04-16T16:46:28Z

On Wed, Apr 15, 2026 at 07:55:01PM +0100, Delene Tchio Romuald wrote:
> In rtw_wep_decrypt(), the payload length is computed as:
>
> length = frame->len - prxattrib->hdrlen - prxattrib->iv_len;
>
> All operands are unsigned. If the frame is shorter than the sum of
> the header length and the IV length, this subtraction wraps around
> and length becomes a huge unsigned value. That value is then used
> to drive an arc4_crypt() call that reads and writes past the end
> of the receive buffer.
>
> An attacker within WiFi radio range can exploit this by sending a
> crafted short WEP-encrypted frame. No authentication is required.
>
> Validate that the frame is large enough to contain a WEP payload
> before computing length.
>
> Found by reviewing length arithmetic in the WEP decrypt path.
> Not tested on hardware.
>
> Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
> Cc: stable@vger.kernel.org
> Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
> Signed-off-by: Delene Tchio Romuald <delenetchior1@gmail.com>
> ---
> v4: add Fixes: tag and Cc: stable (Dan Carpenter); carry Luka Gejak's
> Reviewed-by.
> v3: rebased on staging-next; sent as numbered series with proper
> Cc from get_maintainer.pl.
> v2: rebased on staging-next (v1 was based on v7.0-rc6 and did not
> apply).
>
> drivers/staging/rtl8723bs/core/rtw_security.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/staging/rtl8723bs/core/rtw_security.c b/drivers/staging/rtl8723bs/core/rtw_security.c
> index a00504ff29109..f3bc2240749a4 100644
> --- a/drivers/staging/rtl8723bs/core/rtw_security.c
> +++ b/drivers/staging/rtl8723bs/core/rtw_security.c
> @@ -113,6 +113,12 @@ void rtw_wep_decrypt(struct adapter *padapter, u8 *precvframe)
> memcpy(&wepkey[0], iv, 3);
> /* memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[psecuritypriv->dot11PrivacyKeyIndex].skey[0], keylength); */
> memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[keyindex].skey[0], keylength);
> +
> + /* Ensure the frame is long enough for WEP decryption */
> + if (((union recv_frame *)precvframe)->u.hdr.len <=
> + prxattrib->hdrlen + prxattrib->iv_len)
> + return;

LGTM. Thanks!

regards,
dan carpenter