iwlwifi ScanMatch OOB

Vulnerability analysis

Root Cause: The iwl_mvm_nd_match_info_handler() function performs insufficient length validation before copying data from a firmware notification. The original code only validates that the packet is at least as large as the base struct iwl_scan_offload_match_info, but does not verify there is sufficient space for the variable-length matches array that follows. This allows memcpy to read beyond the allocated buffer boundaries when copying notif->matches data.

Attack Surface: This vulnerability affects systems with Intel iwlwifi wireless hardware during WiFi scan operations. The attack surface is limited to scenarios where the wireless firmware can send malformed scan match notifications with insufficient data length. This typically requires local access to trigger WiFi scanning operations, though the malformed data originates from firmware rather than direct user input.

Fix Mechanism: The patch extends the length validation check to include the size of the matches array (matches_len) in addition to the base structure size. The validation now ensures: len >= sizeof(struct iwl_scan_offload_match_info) + matches_len, guaranteeing sufficient packet length before the memcpy operation proceeds.