Staging rtl8723bs Wi-Fi driver fix targets heap key overflow
A proposed patch rejects oversized cfg80211 key sequence counters that could overrun a fixed buffer in the Realtek SDIO driver.
Feng Ning has put forward a fix for a heap buffer overflow in the staging rtl8723bs Realtek SDIO Wi-Fi driver. Through the cfg80211 key interface, userspace may supply a sequence counter of up to 16 bytes, while the driver stores that value in a fixed 8-byte field. An unchecked copy could write past the end of that field and corrupt adjacent heap data in the same object, including key-length state.
The flaw has existed since the driver entered staging. Ning’s change rejects sequence counters longer than the destination buffer and returns an error instead of copying them, and the work is marked for stable backports because the overflow is reachable by a local user with network-admin privilege.
The submission remains an RFC pending a Tested-by on real rtl8723bs hardware. Kernel maintainer Greg Kroah-Hartman asked for a rebase onto the current tree before the fix advances.