mt76 WiFi Frame OOB Read

Vulnerability analysis

Root Cause: The mt76_connac2_mac_write_txwi_80211() function accesses management frame fields (mgmt->u.action.u.addba_req.capab) without first validating that the skb buffer contains sufficient data. When processing IEEE 802.11 action frames, the code assumes the frame is large enough to contain the ADDBA request structure, but malformed or truncated frames could cause out-of-bounds memory reads.

Attack Surface: This vulnerability affects WiFi-enabled systems using MediaTek MT76 wireless drivers. An attacker with the ability to send malformed 802.11 management frames (either as an associated client or through frame injection) could trigger the out-of-bounds read. The attack requires local wireless network access but does not require authentication or special privileges on the target system.

Fix Mechanism: The patch adds a length check 'skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 + 1 + 2' before accessing the management frame fields. This ensures the buffer contains at least the minimum action frame size plus the additional bytes needed for the category (1 byte), action code (1 byte), and capability field (2 bytes) of the ADDBA request structure.