iwlwifi BANotif OOB

Vulnerability analysis

The Intel iwlwifi driver processes block-ack notifications from the device firmware and uses a traffic identifier field contained in that notification directly as an array index into a per-station data array, without checking whether the value falls within the array's bounds. Because the identifier is a firmware-controlled byte that can take any value from 0 to 255, an out-of-range value causes the driver to read or write memory beyond the allocated array, corrupting adjacent kernel heap objects. The fix adds a bounds check that rejects any notification carrying an invalid identifier before the array is accessed. The vulnerable code path is reached when the WiFi adapter's firmware delivers a block-ack notification during normal wireless operation; an attacker within WiFi range can potentially craft wireless frames that cause the firmware to emit a notification with an out-of-range identifier, triggering the out-of-bounds access in the host kernel without requiring any privileges or user interaction.