CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the ath6kl Wi-Fi driver, where an unvalidated firmware-controlled field can lead to out-of-bounds reads, potentially exposing sensitive memory contents. This flaw could be exploited by an attacker to read up to 1020 bytes beyond the intended buffer, posing a risk to system integrity and confidentiality. Organizations using affected Linux distributions should prioritize patching this vulnerability to mitigate potential exploitation risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buffer length. This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer when the firmware sends an inflated num_msg. Add a check that the buffer is large enough to hold the fixed struct and the num_msg variable-length entries.