Out-of-bounds read (memory safety issue in rtl8723bs OnAssocRsp IE parsing)
Description
The commit fixes an out-of-bounds read in the 802.11 IE parsing during Association Response processing in OnAssocRsp() for the rtl8723bs driver. Previously, the IE parsing loop advanced by (pIE->length + 2) for each IE but only guarded the loop with i < pkt_len. This allowed a malicious AP to craft an Association Response whose last IE ends near the frame boundary (e.g., with only one byte remaining), causing the code to read pframe[pkt_len] and read pIE->length from memory beyond the frame. Additionally, even when headers were within bounds, pIE->length could extend past pkt_len, allowing a truncated/invalid IE to be passed to handler code. The patch adds two guards at the top of the loop: (1) break if fewer than sizeof(*pIE) bytes remain (can't read header), and (2) break if the IE's declared data extends past pkt_len. This prevents out-of-bounds reads, improving memory safety and reducing potential information leakage or crashes from crafted 802.11 frames.
Proof of Concept
Proof-of-concept overview: 1) Build a kernel containing the vulnerable rtl8723bs code and run on a device with the rtl8723bs SDIO wireless controller. 2) Configure a rogue AP (e.g., via hostapd) to serve a crafted Association Response to a connecting client. The crafted Association Response includes an Information Element (IE) near the end of the frame such that the IE header sits at the end-of-frame boundary (pkt_len-1 or pkt_len-2) and the IE length declares more data than actually follows within the frame. 3) When the client associates, the OnAssocRsp() IE parsing loop will encounter a header read near the boundary and, lacking the added guards, perform an out-of-bounds read from pframe and/or read beyond pkt_len through pIE->length. 4) This can lead to a kernel memory access fault (crash) or information leakage, observable via dmesg or system hang/crash. 5) Reproduce by repeatedly performing associations with the malicious AP until the crash or leak is observed. Prerequisites: a test environment with a vulnerable rtl8723bs device, ability to operate a rogue AP capable of sending crafted Association Response frames, and kernel built with the vulnerable code. Note that actual frame crafting requires specialized tooling (e.g., Scapy or a custom driver/user-space helper) and a controlled lab setup.
Commit Details
Author: Alexandru Hossu
Date: 2026-05-22 00:45 UTC
Message:
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each
iteration but only guards on i < pkt_len. When a malicious AP sends an
AssocResponse whose last IE has only one byte remaining in the frame
(the element_id byte lands at pkt_len-1), the loop reads pIE->length
from pframe[pkt_len], which is one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond pkt_len, silently passing a
truncated IE to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past pkt_len.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260522004531.1038924-6-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Triage Assessment
Vulnerability Type: Out-of-bounds read
Confidence: HIGH
Reasoning:
The patch adds bounds checks to an IE parsing loop in OnAssocRsp() to prevent an out-of-bounds read when processing 802.11 IEs. Without these guards, a malicious AP could craft an Association Response that causes a read beyond the received frame, risking memory safety and potential information leakage or further exploitation. This is a concrete memory-safety vulnerability fix in parsing code.
Verification Assessment
Vulnerability Type: Out-of-bounds read (memory safety issue in rtl8723bs OnAssocRsp IE parsing)
Confidence: HIGH
Affected Versions: v7.0-rc6 and earlier (rtl8723bs staging driver; vulnerable prior to this patch)
Code Diff
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
index 70e864cd530d59..a443b3530fb986 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -1371,7 +1371,11 @@ unsigned int OnAssocRsp(struct adapter *padapter, union recv_frame *precv_frame)
/* to handle HT, WMM, rate adaptive, update MAC reg */
/* for not to handle the synchronous IO in the tasklet */
for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;) {
+ if (i + sizeof(*pIE) > pkt_len)
+ break;
pIE = (struct ndis_80211_var_ie *)(pframe + i);
+ if (i + sizeof(*pIE) + pIE->length > pkt_len)
+ break;
switch (pIE->element_id) {
case WLAN_EID_VENDOR_SPECIFIC: