Linux Kernel WiFi mac80211 Out-of-Bounds Write Vulnerability in EPCS Management

A vulnerability in the Linux kernel's WiFi mac80211 subsystem allows for an out-of-bounds write by improperly handling link IDs in the EPCS (Enhanced Power Control Support) management. This issue affects the stable versions of the Linux kernel. The vulnerability arises because the link ID can be set to 15, which exceeds the valid range, leading to a memory access violation. When a WiFi 7 access point sends a specific action frame with an invalid link ID, it can trigger this vulnerability, causing a kernel crash by dereferencing a garbage pointer.

Impact

Exploitation of this vulnerability causes a kernel crash, disrupting system operations and potentially leading to a denial of service.

Reproduction

To reproduce this vulnerability, a WiFi 7 access point must be connected to a device running a vulnerable version of the Linux kernel. The access point can then send an EPCS Enable Response action frame that includes a PER_STA_PROFILE subelement with the link ID set to 15. This triggers the out-of-bounds write by accessing an invalid index in the link array, which is then processed in a way that causes the kernel to crash.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.