In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() The memcpy function assumes the dynamic array notif->matches is at least as large as the number of bytes to copy. Otherwise, results->matches may contain unwanted data. To guarantee safety, extend the validation in one of the checks to ensure sufficient packet length. Found by Linux Verification Center (linuxtesting.org) with SVACE.
| Version | Score | Severity | Vector String |
|---|---|---|---|
| 3.1 | 8.1 | High | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| Product | Vendor | Version |
|---|---|---|
| Linux | Linux | 15.2(4)M3 |
| Linux | Linux | 15.2(4)M5 |
| Linux | Linux | 12.1(3a)XI4 |
| Linux | Linux | 12.0(10)S |