Описание
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: validate monitor transmit frame lengths
rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and
then reads the 802.11 frame control field without checking that a base
802.11 header remains.
The data path also pulls the calculated 802.11, QoS and SNAP header
span before confirming that the skb contains it. A truncated frame can
therefore cause out-of-bounds reads or leave insufficient data for the
Ethernet address writes.
Reject frames that do not contain the base 802.11 header and data
frames that do not contain their complete calculated header span.
A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. This vulnerability occurs because the rtw_cfg80211_monitor_if_xmit_entry() function does not properly validate the length of monitor transmit frames after processing. A remote attacker could exploit this by sending a specially crafted, truncated frame, which may lead to out-of-bounds reads or insufficient data for Ethernet address writes. This could result in information disclosure or a denial of service (DoS).
Отчет
A moderate severity out-of-bounds read flaw was found in the Linux kernel's staging rtl8723bs Wi-Fi driver. The rtw_cfg80211_monitor_if_xmit_entry() monitor-mode transmit path removes the radiotap header and then reads the 802.11 frame control field, and pulls the calculated 802.11, QoS, and SNAP header span, without first verifying that a truncated frame actually contains that data. An attacker able to inject crafted, truncated frames through a monitor-mode interface on an affected system could exploit this flaw to trigger out-of-bounds reads, resulting in limited information disclosure or a kernel crash causing denial of service. Red Hat rates this flaw as moderate impact because exploitation requires local access to transmit frames on a monitor-mode interface and the primary consequence is loss of availability (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This differs from the upstream CVEORG severity of 7.8, which assumes high confidentiality and integrity impact; Red Hat's assessment found the practical impact limited to availability. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw because the vulnerable rtl8723bs staging driver code is not present in the Red Hat shipped kernels.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes. Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes. Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.
In the Linux kernel, the following vulnerability has been resolved: s ...
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes. Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.
EPSS
5.5 Medium
CVSS3