iwlwifi SapMsg Overflow

Vulnerability analysis

The iwlwifi MEI driver receives SAP protocol messages from Intel's CSME firmware through a circular queue and copies them into a local page-sized buffer, but it fails to validate the message length field extracted from the SAP header before reading the message body. A SAP message with a length field exceeding the buffer capacity causes the driver to read past the end of the buffer, producing a heap buffer overflow. The fix adds a bounds check that rejects any SAP message whose declared length plus header size exceeds the local buffer, logging an error and stopping further processing. The vulnerable path is only present on systems with Intel WiFi hardware using the iwlwifi MEI driver; the SAP messages originate from the CSME firmware, which operates independently on the platform and has its own WiFi stack that could be influenced by nearby wireless transmissions.