REDHAT-BUG-2560193: Low severity Intel iwd vulnerability
HE Capabilities validator reads the wrong byte CWE-125. CVSS 3.1: 4.3 Medium CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N src/ie.c:2714 vs src/band.c:631 Introduced 1.30, commit 53988a728533
The Channel Width Set is bits B1-B7 of PHY Capabilities byte 0, element body offset 6 (802.11ax-2021 s9.4.2.248.3). The validator ievalidatehecapabilities() reads offset 7 while bandestimateherxrate() and wiphy.c read offset 6 from the same pointer, so its length guards (len < 26 for the 160 MHz MCS map, len < 30 for 80+80) are keyed on the wrong byte. A 22-byte body with hec[6]=0x1C and hec[7]=0x00 passes validation, then drives the estimator into both branches, reading hec[23..24] and hec[27..28]. The local adapter must also advertise the width, since the two sets are ANDed.
Passive scanning reaches this path before association. In a real beacon the OOB reads consume attacker-controlled bytes from the following element, influencing the rate used for BSS ranking. Only the HE Capabilities element must be malformed.
The fix is one character: (ptr + 7) -> (ptr + 6).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Intel iwd with an adapter that advertises the relevant HE channel widths are exposed while passively scanning nearby Wi-Fi networks. Association is not required.
What must an attacker provide to trigger it?
An attacker needs to transmit a beacon containing a malformed 22-byte HE Capabilities element. The local adapter must also advertise the affected width, because the advertised width sets are combined.
What is the practical impact of successful exploitation?
The out-of-bounds reads consume attacker-controlled bytes from the following information element and can influence the receive rate used for BSS ranking. The provided CVSS vector indicates network-adjacent attack access with no privileges or user interaction required.
How can the code issue be corrected?
The validator should read PHY Capabilities byte 0 at pointer offset 6 rather than offset 7. This aligns its channel-width check and length guards with the estimator and wiphy code.