cfg80211 AssocResp OOB

Vulnerability analysis

When a WiFi device receives an association response frame, the wireless configuration layer extracts the status code and information-element fields from the frame before verifying the frame is long enough to contain them. A too-short frame causes the information-element length calculation to wrap to a huge value, making the kernel read far past the frame buffer—which can leak kernel memory and crash the system when the over-read hits an unmapped page. The fix defers all field extraction until after a length check that accounts for the different offsets used by sub-1 GHz and regular association responses, and cleanly abandons the connection if the frame is too short. The flaw is reachable by any nearby radio that can send WiFi management frames to a device during association, such as a rogue access point or a man-in-the-middle, and requires no account or privileges on the target.