In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
Set the size to 6 instead of 2, since 'para' array is passed to
'rtw_fw_bt_wifi_control(rtwdev, para[0], ¶[1])', which reads
5 bytes:
void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)
{
...
SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);
SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));
...
SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));
Detected using the static analysis tool - Svace.
CVSS
No CVSS.
References
Configurations
No configuration.
History
03 Jul 2025, 15:13
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
03 Jul 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-03 09:15
Updated : 2025-07-03 15:13
NVD link : CVE-2025-38159
Mitre link : CVE-2025-38159
CVE.ORG link : CVE-2025-38159
JSON object : View
Products Affected
No product.
CWE
No CWE.