kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/staging/rtl8723bs
History
Navaneeth K d1ab7f9cee staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing 
commit 502ddcc405 upstream.

The Extended Supported Rates (ESR) IE handling in OnBeacon accessed
*(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these
offsets lie within the received frame buffer. A malformed beacon with
an ESR IE positioned at the end of the buffer could cause an
out-of-bounds read, potentially triggering a kernel panic.

Add a boundary check to ensure that the ESR IE body and the subsequent
bytes are within the limits of the frame before attempting to access
them.

This prevents OOB reads caused by malformed beacon frames.

Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-12-12 18:37:21 +01:00
..
core staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing 2025-12-12 18:37:21 +01:00
hal staging: rtl8723bs: Remove unused files rtw_debug.c and rtw_debug.h 2024-09-11 15:57:48 +02:00
include staging: rtl8723bs: include: Remove spaces before tabs in rtw_security.h 2024-09-13 07:31:22 +02:00
os_dep move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
Kconfig staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES 2025-04-10 14:39:25 +02:00
Makefile staging: rtl8723bs: Remove unused file rtw_rf.c 2024-09-11 15:57:48 +02:00
TODO staging: rtl8723bs: remove item from TODO list 2021-06-24 14:43:46 +02:00