From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vk1-f174.google.com (mail-vk1-f174.google.com [209.85.221.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6DAB9339844 for ; Sun, 5 Apr 2026 10:17:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775384262; cv=none; b=aakZMj1eutikfoPg8we8pDGJGHKLagWku/qOAi2Q9RzLNJr8HIw8IxfeJR6ZKwqmd19WuLuZPUS9PYUdjc9IQOskhibY6olOss/dgZ+6xl0OJev9vjaEf9prmOxLsRamqc9yZxeFf6gKBgO2QysAOb+18QBAPkr0zsVOimBUq8A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775384262; c=relaxed/simple; bh=yfx6lPvgGD1BjXJbwxifAAQq3rRl0uxOfdzToGyIlaw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jvl0mVOliRwUJBOfGdm5fRu2B1SSVNmwfSkpBw/FKgpBohZbHUEQx30N7mUjMykGXaDDptf1P8e0/UjzofnsYQdyGmQxS5kkMTgfF0XKD672s/ateQMpce22b/jN50xKlsJ4xge1h64/XtZy7zQHS3GeexNzM0OATws56SiFVoc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NGCK02gr; arc=none smtp.client-ip=209.85.221.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NGCK02gr" Received: by mail-vk1-f174.google.com with SMTP id 71dfb90a1353d-56b8804f37cso1233613e0c.3 for ; Sun, 05 Apr 2026 03:17:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775384260; x=1775989060; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=iC79OkyMhpMLObAOX6AAjV7rcE6Oha7GoNELSHflFk4=; b=NGCK02gr0XAFMGq9Nr8puSD7sHIj/HnaPMK3jkEQvLcHRUKQtGLvhl2wIaF3XiIVJH jKhqA1FbBKtPjqcWobwBg7Pi2ATFjCB++sHWxRR3VBIA79fLUvc+5CkdTdbufRn9a+ds hI5E+jaMXrCSl9JcGwuKPPHzl4eZh7mEsuwjBY7rn+u5gGw1cvWQU5ufDh4rr4kl5vVc GPB2KnSqXdYXyypaHaJbsXU+ooNtLE8kxT+pY2O6bZyn84FHpKfpRN7qmz3LfqGPPyGQ io1hpefeXODz91IXWJytVdotRqgM8kar7T1dE4JHKQ5jNYv519KWibyvGhyb5460m3G1 f2KQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775384260; x=1775989060; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=iC79OkyMhpMLObAOX6AAjV7rcE6Oha7GoNELSHflFk4=; b=s70b5Qt+ym3uFIxSTGd4qQdB5Z541g0zky37Pq/h8ODWMy0owiMOeMukB9wkn081h+ Oypdg+8uV+hIxMXBc22JqLPmsGZLd6pfmug/33nBkhS8xMcfiCBa+586IAUsQL5eHPVV JkJbezIwq3jNaICqNKjVg+GjkqkqJIB4RmjPBUsfHgBuDQYvSjX7YPYb9lnA8SZTBqnU MbJ19D02n/uQeI7EFpBjL+HlJwpSLKEwDgxtbKMjr6o0De2lyVTyTWE+TwKJ+zxYOk8l y2uUfFSmR33qVCPBH1NUSoN5ULjEmkiCPxawD0qdZeb/A9+YOy90xiiZqcdgxSJxtKkX B4HA== X-Forwarded-Encrypted: i=1; AJvYcCV38LA2+rUbeav1mrmOnwPch9k/D0Nh6be1J6X0yE6tJkh8ZalO3IU8COeBBkEUo5bWsPKHYgV/vTx6Izw=@vger.kernel.org X-Gm-Message-State: AOJu0YxGhUD3l3ATtvKuMiLePHLzrEHK7TKF9OLE4ibX/YN1avjhQ+qA wcRc4h6BugmkmSioxq/+JGuSkdePAR3KNDvqfnmhknb+mzMfTyO9UCDj X-Gm-Gg: AeBDietRDo/DBln2GejGN/S1Su0d1PF7XqmoG4D8/9Bz0SRJA13xxoV2mdFoVDePNQn u5XeWARlNPV46ctsN5vUfn3Uatos81XYQT7UaNr/CdX+0kcLRjifYhKS5iT1x2Fk+8DOPXF6mv6 3SRGYfHHO4cm6y/sp8VA4HZSjpJgUEGeFGWBneoxBb2OLHKPSaSTg6nFemM8I6gH7RUqgJAoqd8 qn6qb1iIWkrk1aI2bTDTlfONQZv2QY5+JepMC9i6+7T3u7JSwW7XgfPWoUNoh2JCeIvn0PGqecC a0bbqLnOTd7dJU4pAZO1P5Y5FgvCgDvOL6XjAMO3polHOZL+mdXxGrBkZGMUbhI39p4GTJmJ0tC BTEpxhzyjB6t8fB23VqWxJvhxiOPTxOdTuqa1N9yXd6A+tXDNeYLdt6ZDjByFiL/twLAY64l+YH IMFF5zkLhUcwbuXCzzhY0c5hwn8BStgZIhpolPbuqc X-Received: by 2002:a05:6102:9d7:b0:5ff:ba2d:17a6 with SMTP id ada2fe7eead31-605a48923f3mr2888675137.0.1775384260395; Sun, 05 Apr 2026 03:17:40 -0700 (PDT) Received: from localhost.localdomain ([102.244.98.15]) by smtp.gmail.com with ESMTPSA id a1e0cc1a2514c-953fb897b8dsm10473385241.7.2026.04.05.03.17.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 05 Apr 2026 03:17:39 -0700 (PDT) From: Delene Tchio Romuald To: gregkh@linuxfoundation.org Cc: Ethan Tidmore , Sam Daly , linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Delene Tchio Romuald Subject: [PATCH v3 4/5] staging: rtl8723bs: fix out-of-bounds reads in IE parsing functions Date: Sun, 5 Apr 2026 11:15:47 +0100 Message-ID: <20260405101548.124829-5-delenetchior1@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260405101548.124829-1-delenetchior1@gmail.com> References: <20260405101548.124829-1-delenetchior1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The IE parsing loops in rtw_get_wapi_ie(), rtw_get_sec_ie(), and rtw_get_wps_ie() check only that the element ID byte is within bounds (cnt < in_len), but then immediately access the length byte at in_ie[cnt+1] and data bytes at in_ie[cnt+2] and beyond without verifying that these offsets are within the buffer. A malicious access point can send beacon or probe response frames with truncated Information Elements, triggering out-of-bounds reads on kernel heap memory. No authentication is required. Add two bounds checks to each function: - Ensure at least 2 bytes remain for the IE header (cnt + 1 < in_len) - Validate the full IE fits in the buffer before accessing its data (cnt + 2 + ie_len <= in_len) Found by reviewing memory operations in the driver. Not tested on hardware. Signed-off-by: Delene Tchio Romuald --- v3: - Rebased on staging-next - Sent as numbered series with proper Cc from get_maintainer.pl v2: - Rebased on staging-next (v1 did not apply due to code reformatting) drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c index 72b7f731dd471..e0fed3f42de0c 100644 --- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c +++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c @@ -582,9 +582,12 @@ int rtw_get_wapi_ie(u8 *in_ie, uint in_len, u8 *wapi_ie, u16 *wapi_len) cnt = (_TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_); - while (cnt < in_len) { + while (cnt + 1 < in_len) { authmode = in_ie[cnt]; + if (cnt + 2 + in_ie[cnt + 1] > in_len) + break; + if (authmode == WLAN_EID_BSS_AC_ACCESS_DELAY && (!memcmp(&in_ie[cnt + 6], wapi_oui1, 4) || !memcmp(&in_ie[cnt + 6], wapi_oui2, 4))) { @@ -615,9 +618,12 @@ void rtw_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len, u8 *wpa_ie cnt = (_TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_); - while (cnt < in_len) { + while (cnt + 1 < in_len) { authmode = in_ie[cnt]; + if (cnt + 2 + in_ie[cnt + 1] > in_len) + break; + if ((authmode == WLAN_EID_VENDOR_SPECIFIC) && (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) { if (wpa_ie) @@ -658,9 +664,12 @@ u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen) cnt = 0; - while (cnt < in_len) { + while (cnt + 1 < in_len) { eid = in_ie[cnt]; + if (cnt + 2 + in_ie[cnt + 1] > in_len) + break; + if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) { wpsie_ptr = &in_ie[cnt]; -- 2.43.0