CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's carl9170 driver, specifically in the TX status handler, where an off-by-two error in the bounds check can lead to an out-of-bounds read. This flaw may allow attackers to exploit the driver by manipulating firmware-controlled headers, potentially leading to information disclosure or system instability. Organizations using affected Linux distributions, particularly those relying on the carl9170 driver for wireless communication, should prioritize applying the fix to mitigate potential risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`.