PT-2026-64667 · Linux · Linux
CVE-2026-64446
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix heap buffer overflow in rtw cfg80211 set wpa ie()
supplicant ie is a 256-byte array in struct security priv. The WPA and
WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant ie, &pwpa[0], wpa ielen + 2);
where wpa ielen is the raw IE length field (u8, 0-255). When a local user
supplies a connect request via nl80211 with a crafted WPA IE of length 255,
wpa ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into
the adjacent last mic err time field.
rtw parse wpa ie() does not prevent this: its length consistency check
compares *(wpa ie+1) against (u8)(wpa ie len-2), which is (u8)(255) == 255
when wpa ie len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the
memcpy, rejecting any IE whose total size (wpa ielen + 2) exceeds the
supplicant ie buffer.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux