Описание
In the Linux kernel, the following vulnerability has been resolved:
wifi: wfx: validate MIB read length before copying to caller
wfx_hif_read_mib() copies reply->length bytes from the firmware
response into the caller-provided buffer without checking that
reply->length does not exceed val_len. A firmware response with
a length field larger than expected overruns the caller buffer and
reads past the end of the reply allocation.
Replace the dead -ENOMEM check with an active validation that
reply->length fits within val_len before the memcpy.
A flaw was found in the Linux kernel's Silicon Labs WFx Wi-Fi driver. The driver fails to validate the length of firmware responses during Management Information Base (MIB) queries before copying the data into memory buffers. A compromised or malicious wireless device could supply an oversized response, causing a buffer overflow that leads to memory corruption and a Denial of Service (DoS) via a system crash.
Отчет
wfx_hif_read_mib trusts the length supplied in a firmware MIB response and passes it to memcpy without verifying that it fits in the caller provided buffer. An oversized response therefore causes both an out of bounds read from the reply allocation and an out of bounds write into adjacent kernel memory. The immediate impact can include kernel memory corruption and a system crash. Depending on the affected caller buffer and adjacent objects, information disclosure or privilege escalation may also be possible, but reliable control of the corrupted data is not established. For the CVSS the PR:L in the paranoid score represents environments where a local service account, container root, or user with delegated wireless administration can reach the relevant driver operations. Typical systems may instead require PR:H to manage the interface or install modified firmware. The issue is not proven to be directly network reachable because ordinary WiFi peers do not normally control firmware generated MIB confirmation lengths. A malicious or compromised device firmware is the clearest supported trigger condition.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer without checking that reply->length does not exceed val_len. A firmware response with a length field larger than expected overruns the caller buffer and reads past the end of the reply allocation. Replace the dead -ENOMEM check with an active validation that reply->length fits within val_len before the memcpy.
In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer without checking that reply->length does not exceed val_len. A firmware response with a length field larger than expected overruns the caller buffer and reads past the end of the reply allocation. Replace the dead -ENOMEM check with an active validation that reply->length fits within val_len before the memcpy.
wifi: wfx: validate MIB read length before copying to caller
In the Linux kernel, the following vulnerability has been resolved: w ...
In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer without checking that reply->length does not exceed val_len. A firmware response with a length field larger than expected overruns the caller buffer and reads past the end of the reply allocation. Replace the dead -ENOMEM check with an active validation that reply->length fits within val_len before the memcpy.
EPSS
5.5 Medium
CVSS3