staging: rtl8723bs: fix remote heap information disclosure in issue_assocreq

From: Luka Gejak <[email protected]>

When building an association request frame, the driver copies the ht capability ie using the attacker-controlled pIE->length from the ap's beacon. If the ap provides a length greater than the size of struct HT_caps_element (26 bytes), it causes an out-of-bounds read of the adjacent heap memory (HT_info and network structures). This uninitialized or sensitive memory is then transmitted over the air, resulting in a remote heap information disclosure.

Fix this by clamping the length passed to rtw_set_ie() to the actual size of struct HT_caps_element.

Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")

Cc [email protected]

Signed-off-by Luka Gejak <[email protected]>

---
---
Changes in v2:
- Refactored rtw_set_ie() alignment to follow "open parenthesis" style.
- Allowed the line length to exceed 100 characters for better readability as requested by Greg KH.

 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +0 -0

index 5f00fe282d1b..08e597bc0345 100644

Quoted 30 lines · On Wed, Apr 15, 2026 at 07:03:02AM +0200, [email protected] wrote:

From: Luka Gejak <[email protected]>

When building an association request frame, the driver copies the ht capability ie using the attacker-controlled pIE->length from the ap's beacon. If the ap provides a length greater than the size of struct HT_caps_element (26 bytes), it causes an out-of-bounds read of the adjacent heap memory (HT_info and network structures). This uninitialized or sensitive memory is then transmitted over the air, resulting in a remote heap information disclosure.

Fix this by clamping the length passed to rtw_set_ie() to the actual size of struct HT_caps_element.

Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")

Cc [email protected]

Signed-off-by Luka Gejak <[email protected]>

---
---
Changes in v2:
- Refactored rtw_set_ie() alignment to follow "open parenthesis" style.
- Allowed the line length to exceed 100 characters for better readability as requested by Greg KH.

 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +0 -0

index 5f00fe282d1b..08e597bc0345 100644

drivers/staging/rtl8723bs/core/rtw_mlme_ext.c void issue_assocreq(struct adapter *padapter) · line 2959

Quoted 7 lines

drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +3 -1

@@ -2954,7 +2954,9 @@ void issue_assocreq(struct adapter *padapter)
 			if (padapter->mlmepriv.htpriv.ht_option) {
 				if (!(is_ap_in_tkip(padapter))) {
 					memcpy(&(pmlmeinfo->HT_caps), pIE->data, sizeof(struct HT_caps_element));
-					pframe = rtw_set_ie(pframe, WLAN_EID_HT_CAPABILITY, pIE->length, (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
+					pframe = rtw_set_ie(pframe, WLAN_EID_HT_CAPABILITY,
+							    min_t(uint, pIE->length, sizeof(struct HT_caps_element)),
+							    (u8 *)&pmlmeinfo->HT_caps, &pattrib->pktlen);

You're being conservative and trying to work around the invalid pIE->length, but in the case where the original code corrupts memory, we're allow to just give up and return a failure.

There are two other cases where we trust pIE->length in this function and those need to be fixed as well.

regards,
dan carpenter

Quoted 46 lines · Dan Carpenter

Quoted 30 lines · On Wed, Apr 15, 2026 at 07:03:02AM +0200, [email protected] wrote:

From: Luka Gejak <[email protected]>

When building an association request frame, the driver copies the ht capability ie using the attacker-controlled pIE->length from the ap's beacon. If the ap provides a length greater than the size of struct HT_caps_element (26 bytes), it causes an out-of-bounds read of the adjacent heap memory (HT_info and network structures). This uninitialized or sensitive memory is then transmitted over the air, resulting in a remote heap information disclosure.

Fix this by clamping the length passed to rtw_set_ie() to the actual size of struct HT_caps_element.

Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")

Cc [email protected]

Signed-off-by Luka Gejak <[email protected]>

---
---
Changes in v2:
- Refactored rtw_set_ie() alignment to follow "open parenthesis" style.
- Allowed the line length to exceed 100 characters for better readability as requested by Greg KH.

 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +0 -0

index 5f00fe282d1b..08e597bc0345 100644

drivers/staging/rtl8723bs/core/rtw_mlme_ext.c void issue_assocreq(struct adapter *padapter) · line 2959

Quoted 7 lines

drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +3 -1

@@ -2954,7 +2954,9 @@ void issue_assocreq(struct adapter *padapter)
 			if (padapter->mlmepriv.htpriv.ht_option) {
 				if (!(is_ap_in_tkip(padapter))) {
 					memcpy(&(pmlmeinfo->HT_caps), pIE->data, sizeof(struct HT_caps_element));
-					pframe = rtw_set_ie(pframe, WLAN_EID_HT_CAPABILITY, pIE->length, (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
+					pframe = rtw_set_ie(pframe, WLAN_EID_HT_CAPABILITY,
+							    min_t(uint, pIE->length, sizeof(struct HT_caps_element)),
+							    (u8 *)&pmlmeinfo->HT_caps, &pattrib->pktlen);

You're being conservative and trying to work around the invalid pIE->length, but in the case where the original code corrupts memory, we're allow to just give up and return a failure.

There are two other cases where we trust pIE->length in this function and those need to be fixed as well.

Quoted 2 lines

regards,
dan carpenter

Hi Dan,
should I keep my approach as is or just return failure. I will fix other cases as well with whatever approach you consider correct.