Linux Kernel ath11k Buffer Overflow Vulnerability in Active Probe SSID and BSSID Handling

A buffer overflow vulnerability has been identified in the Linux kernel's ath11k wireless driver. This issue arises from a mismatch between the reported maximum number of SSIDs for active probe requests and the actual capacity of the scan request parameters structure. The driver reports a maximum of 16 SSIDs, while the structure can only hold 10. This discrepancy allows for a buffer overflow that can be triggered by wpa_supplicant in userspace. The vulnerability occurs when the SSIDs are copied into the scan request parameters, potentially overwriting important data such as the extra IE pointer.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or memory corruption.