Array Overrun Vulnerability in rtw88 Package
Summary
GSD-2021-1000441: rtw88: Fix array overrun in rtw_get_tx_power_params(). Affects Kernel versions >= fa6dfe6bff246ddd5be3cfe81637f137acd6c294, < 6b5aa0cf321c25f41e09a61c83ee4dc7ab9549cb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The rtw88 package is a component of the Linux Kernel, which is responsible for managing wireless network adapters that use the Realtek RTL8822BE chipset. It provides the necessary drivers and functionality for these devices to connect to and communicate with wireless networks. The vulnerability in question affects the rtw_get_tx_power_params() function within the rtw88 package.
Vulnerability Detail
The vulnerability in rtw_get_tx_power_params() is caused by an array overrun, which occurs when the function attempts to access elements beyond the bounds of an array. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service. The vulnerability was introduced in version v5.3 of the Linux Kernel and has been fixed in version v5.4.119 by commit 6b5aa0cf321c25f41e09a61c83ee4dc7ab9549cb.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a temporary workaround is to disable the affected functionality by blacklisting the rtw88 module. This can be done by adding the following line to the /etc/modprobe.d/blacklist.conf file:
blacklist rtw88
After making this change, restart the system for the blacklist to take effect. Note that this workaround will disable the wireless network adapter that relies on the rtw88 module.
Conclusion
The array overrun vulnerability in the rtw_get_tx_power_params() function of the rtw88 package can potentially allow an attacker to execute arbitrary code or cause a denial of service. It is crucial to update the Linux Kernel to version v5.4.119 or later to mitigate this vulnerability. Alternatively, a temporary workaround is available by blacklisting the rtw88 module. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service by exploiting the array overrun in the rtw_get_tx_power_params() function.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
Yes, the vulnerability has been fixed in version v5.4.119 of the Linux Kernel. It is recommended to update to this version or later to mitigate the vulnerability.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the fix as soon as possible to prevent potential exploitation.
Yes, a temporary workaround is available by blacklisting the rtw88 module. However, it is still recommended to update the kernel to the fixed version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
