In the Linux kernel, the following vulnerability has been resolved:
wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
The firmware response dispatcher copies all synchronous HAL responses
into the 4096-byte hal_buf without validating the response length. A
response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow
with firmware-controlled content.
Add a bounds check on the response length.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 6
https://git.kernel.org/stable/c/15545ee71301e82d26d9a31b407ed0019eb62a60
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/18813b90032bfaafb225906a4d2b51be4dfc02c3
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/88a240d86d3d64521f9194abe185ac71cc74d0bd
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dae9cadf0925f1cbfb71306d60490890df3870a6
416baaa9-dc9f-4396-8d5f-8c081fb06d67