CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's ath6kl Wi-Fi driver, where insufficient validation of firmware-controlled lengths can lead to out-of-bounds reads during information element (IE) parsing. This may result in state corruption, potentially impacting system stability and security. Linux system administrators and developers utilizing the ath6kl driver should prioritize applying the patch to mitigate these risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled. Add a check that the total IE length fits within the buffer.