Buffer Overflow in nRF70 Wi-Fi Driver

Executive Summary

This vulnerability exists in the nRF70 Wi-Fi driver's power-save event handler function called nrf_wifi_event_proc_get_power_save_info(). The function copies Target Wake Time (TWT) flow entries from an event into a fixed-size array without properly validating the number of flows against the array's maximum capacity (8 entries).

When the number of TWT flows exceeds this limit, the function writes beyond the bounds of the destination array, causing an out-of-bounds write of approximately 40 bytes. It also reads beyond the event buffer, leading to memory corruption.

The event triggering this overflow is sent by the nRF70 co-processor firmware in response to a host-initiated power-save GET request. Exploiting this requires the firmware to send a malformed or out-of-range event, which is a trusted boundary scenario rather than a direct remote attack.

This vulnerability can corrupt stack memory, including return addresses or local variables, and can cause secondary out-of-bounds reads and potential memory disclosure, especially when the corrupted data is later processed by shell commands.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption through out-of-bounds writes and reads in the Wi-Fi driver's power-save event handler.

• It can overwrite adjacent stack memory, potentially corrupting return addresses or local variables.
• The corrupted memory can cause unexpected behavior, crashes, or denial of service in the affected system.
• Secondary out-of-bounds reads caused by processing corrupted data may lead to information disclosure.
• Exploitation requires a malformed event from the trusted co-processor firmware, so remote exploitation is limited but possible through indirect influence.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an out-of-bounds write and read in the nRF70 Wi-Fi driver's power-save event handler due to unchecked num_twt_flows values. Detection would involve monitoring for malformed power-save events with num_twt_flows exceeding the maximum allowed (8).

Since the overflow occurs in the handling of firmware-supplied events, detection on the network level is indirect and complex. However, you can look for abnormal or malformed power-save GET responses from the nRF70 co-processor firmware.

Commands to detect this vulnerability specifically are not provided in the available resources. However, monitoring logs for error messages related to power-save event processing or unexpected behavior in the wifi_ps_config structure (such as crashes or memory corruption symptoms) could help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to apply the patch that validates the num_twt_flows value against the maximum allowed (WIFI_MAX_TWT_FLOWS = 8) and checks the event length before processing the power-save event.

If the validation fails, the handler logs an error and returns early, preventing out-of-bounds memory access and potential memory corruption.

Ensure your system is updated to a Zephyr RTOS version that includes the fix (main branch or v4.4/v4.3 branches). If updating immediately is not possible, consider disabling or restricting the use of the power-save GET command or the affected nRF70 Wi-Fi driver functionality until the patch can be applied.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0