Re: [PATCH] staging: rtl8723bs: fix out-of-bounds reads in IE parsing functions

[Ethan Tidmore]

On Sat Apr 4, 2026 at 5:31 PM CDT, Delene Tchio Romuald wrote:
> The IE parsing loops in rtw_get_wapi_ie(), rtw_get_sec_ie(), and
> rtw_get_wps_ie() check only that the element ID byte is within bounds
> (cnt < in_len), but then immediately access the length byte at
> in_ie[cnt+1] and data bytes at in_ie[cnt+2] and beyond without
> verifying that these offsets are within the buffer.
>
> A malicious access point can send beacon or probe response frames with
> truncated Information Elements, triggering out-of-bounds reads on
> kernel heap memory. No authentication is required.
>
> Add two bounds checks to each function:
>  - Ensure at least 2 bytes remain for the IE header (cnt + 1 < in_len)
>  - Validate the full IE fits in the buffer before accessing its data
>    (cnt + 2 + ie_len <= in_len)
>
> Cc: stable@xxxxxxxxxxxxxxx

You'd want a proper fixes tag if this is a actual bug.

> Signed-off-by: Delene Tchio Romuald <delenetchior1@xxxxxxxxx>
> ---

This doesn't apply to staging-next.

Thanks,

ET