Mitigation Strategies

To mitigate this vulnerability, update your Linux kernel to a version where the staging: rtl8723bs driver has been patched to fix the stack buffer overflow in OnAssocReq IE parsing. This update clamps the IE length to the buffer size before copying, preventing stack corruption caused by malformed association requests.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a stack buffer overflow in the Linux kernel's rtl8723bs driver during the parsing of the Supported Rates Information Element (IE) in an incoming Association Request frame. The length of the Supported Rates IE was used directly as the length parameter in a memcpy() call to copy data into a fixed-size 16-byte stack buffer. If a malicious station sends an IE length larger than 16 bytes, it causes a stack buffer overflow, potentially corrupting the kernel stack. The fix clamps the IE length to the buffer size and corrects bounds checking to prevent this overflow.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to kernel stack corruption if exploited by a malicious station sending malformed association requests with oversized Supported Rates IE lengths. Such stack corruption could potentially be used to execute arbitrary code or cause a denial of service by crashing the kernel, impacting system stability and security.

Useful 0 Not Useful 0