Executive brief
A staging network driver component in the Linux kernel contains a buffer overflow vulnerability in its wireless encryption key handling. An attacker can supply a key length parameter exceeding safe limits, corrupting kernel memory and potentially gaining code execution with kernel privileges.
Technical details
The vulnerability is a heap buffer overflow in the ks7010 staging driver's ks_wlan_set_encode_ext() function. The function accepts a user-controlled u16 key_len parameter without validation and directly uses it in a memcpy() call to a fixed-size buffer (key_val[]), which can hold a maximum of IW_ENCODING_TOKEN_MAX (64) bytes. An attacker with local access can call the function with key_len values exceeding 64, causing the memcpy to write beyond buffer boundaries. The fix clamps the key_len value to the maximum safe length using clamp_val(). Exploitation requires local access and ability to invoke wireless configuration operations.
Affected products
- Linux Linux kernel Multiple versions (patched in upstream and backported to stable branches via commit 5f1c7031e044cb2fba82836d55cc235e2ad619dc)
Timeline
- 2023-07-09: disclosed: Vulnerability reported by Zhang Shurong
- 2023-07-27: patched: Fix merged upstream in commit 5f1c7031e044cb2fba82836d55cc235e2ad619dc
- 2023-08-11: patched: Backported to stable kernel branches