iwlwifi WoWLAN Underflow

Vulnerability analysis

When a system with an Intel WiFi adapter wakes from suspend via WoWLAN, the firmware reports the packet that triggered the wakeup. The kernel code in the iwlwifi driver trusted the firmware's reported packet length without verifying it was large enough to cover the 802.11 header, encryption IV, and integrity check fields. Subtracting those offsets from an undersized length caused an integer underflow, producing a very large value subsequently used as a copy length, leading to out-of-bounds memory reads and writes. The fix adds validation checks that reject packets too small to contain a valid header or to cover the header plus encryption overhead, returning early before any subtractions or copies occur. The vulnerable path is reachable by an attacker within WiFi range of a device using the iwlwifi driver with WoWLAN enabled and the system in a suspended state; no OS-level privileges are required.