CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's carl9170 Wi-Fi driver, where a length mismatch in command responses from the firmware can lead to an out-of-bounds read during a memcpy operation. This flaw could potentially allow an attacker to exploit the driver, leading to unauthorized access to memory beyond the allocated buffer. Organizations using Linux systems with the carl9170 driver should prioritize patching this vulnerability to mitigate the risk of memory corruption and potential exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4). Since len comes from the firmware and can exceed ar->readlen, this copies more data than the readbuf was allocated for. Bound the memcpy to min(len - 4, ar->readlen) so that the response is still completed -- avoiding repeated restarts from queued garbage -- while preventing an overread past the response buffer.