Linux Kernel rtw89 Out-of-Bounds Access Vulnerability

A vulnerability in the Linux kernel's rtw89 wireless driver can lead to out-of-bounds memory access. This issue arises because the hardware may report incorrect MAC IDs, which can overwrite memory. The vulnerability was identified by Undefined Behavior Sanitizer (UBSAN) as an array index out-of-bounds error in rtw89/phy.c, where an index of 188 exceeded the valid range for a specific array type. The problem occurs in the rtw89_core module during the reception of data, particularly when the driver processes information from the PCI interrupt.

Impact

Exploitation of this vulnerability can cause memory corruption by allowing the driver to access memory outside the bounds of allocated arrays. This could potentially lead to arbitrary code execution or other forms of memory-related vulnerabilities, such as use-after-free errors.