Executive Summary

This vulnerability exists in the Linux kernel's b43 wireless driver. Specifically, the firmware-controlled key index used in the b43_rx() function can exceed the size of the device's key array, which has 58 entries. The existing warning mechanism (B43_WARN_ON) that detects this out-of-bounds access is not enforced in production builds, allowing an out-of-bounds read to occur. The fix enforces this check by dropping any frame where the firmware returns an invalid key index, preventing the out-of-bounds read.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to an out-of-bounds read in the Linux kernel's wireless driver, which may cause unexpected behavior such as crashes or information leakage. Since the key index can exceed the valid range, it might allow the firmware to access memory outside the intended bounds, potentially leading to instability or exposing sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability in the Linux kernel's b43 driver involves an out-of-bounds read due to a non-enforcing bounds check on the firmware key index.

To mitigate this vulnerability, update your Linux kernel to a version where the B43_WARN_ON check is made enforcing, which drops frames when the firmware returns an invalid key index.

Useful 0 Not Useful 0