In the Linux kernel, the following vulnerability has been resolved:
wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
The firmware-controlled rsp->count field is used as the loop bound for
indexing into the flexible rsp->regs[] array without validation against
the message length. A count exceeding the actual data causes out-of-
bounds reads from the heap-allocated message buffer.
Add a check that count fits within the received message.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/0907c06dccae9e3c8d5a68eb9014beec73a36e79
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/22b0b8572a64362531dd0ed499b75e16282aeb2b
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/23d210877968657bd07e1a517e0b516db20a1d80
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3cf92b44c4fb88a5e8de8733a4494c0956606bca
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/64228dfc4247aca178c01e5a37af7d8dcc7a6089
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/df2187acfca6c6cca372c5d35f42394d9c270b09
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f03782f7f41f2afee5076a1ef08ced5649218771
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f987efff29a5fe45320ea5991c9d5cb98b676953
416baaa9-dc9f-4396-8d5f-8c081fb06d67