Executive brief
The rtl8723bs WiFi driver in the Linux kernel contains a buffer overflow vulnerability in its WEP shared-key authentication handler. A malicious wireless access point can send a crafted authentication challenge to trigger the overflow before a user even connects, potentially allowing the attacker to execute code or leak sensitive memory from the system running the vulnerable driver.
Technical details
The vulnerability is a classic buffer overflow in the OnAuthClient() function of the rtl8723bs staging driver. The WEP shared-key authentication handler calls rtw_get_ie() to extract a WLAN_EID_CHALLENGE element from an authentication frame, retrieving an attacker-controlled length field (up to 255 bytes). This length is then used directly in memcpy() to write into a fixed 128-byte buffer (pmlmeinfo->chg_txt) without validation. A malicious AP can send a malformed WLAN_EID_CHALLENGE element with length > 128, causing out-of-bounds writes (overflow) or leak stale memory (underfill). The attack is remotely reachable over the air during the pre-association authentication phase. The fix validates that the challenge length matches the required WLAN_AUTH_CHALLENGE_LEN constant (128 bytes) before performing the copy.
Affected products
- Linux Linux kernel Multiple kernel versions (staging driver rtl8723bs)
Timeline
- 2026-08-22: disclosed
- 2026-07-28: patched: Patch committed upstream by Greg Kroah-Hartman