iwlwifi TxResp OOB

Vulnerability analysis

The WiFi driver uses a count provided by the firmware in a transmit response to walk through status entries and then read a trailing value at the end of the response. It did not verify that the response buffer was actually large enough to contain all the entries implied by that count. When the firmware supplies a larger count than the buffer can hold, the driver reads past the end of the buffer into adjacent kernel memory. The fix calculates the exact minimum size required for the reported count and discards any response that is too small. It also rejects responses with a count other than one when a newer firmware interface is in use. The bug is reached during normal wireless operation; an attacker only needs to be within radio range of a device using an affected Intel wireless adapter and can trigger it by sending crafted wireless traffic that causes the firmware to generate malformed transmit status reports.