Memory corruption

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE...

CVE-2023-43520

CVE-2023-43520 is a memory corruption issue in Qualcomm WLAN components, arising when an Access Point includes a TID-to-link mapping Information Element in beacons and a station parses it. The vulnerability is documented across multiple sources (NVD/NVIDIA CVE entry, Red Hat advisory) with a base...

CVE-2023-43520 Stack-based Buffer Overflow in WLAN HOST

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE...

sta-catalina.com Improper Access Control vulnerability OBB-3812333

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kernel: wifi: rtw88: use work to update rate to avoid RCU warning

A flaw was identified in the Linux kernel’s rtw88 Wi-Fi driver drivers/net/wireless/realtek/rtw88 where the ieee80211ops::starcupdate callback was invoked within a Read-Copy-Update RCU read-side critical section without proper atomicity or deferral. The ieee80211chanbwchange function holds an RCU...

CVE-2023-33020

Transient DOS in WLAN Host when an invalid channel like channel out of range is received in STA during CSA IE...

Code injection

Transient DOS in WLAN Host when an invalid channel like channel out of range is received in STA during CSA IE...

CVE-2023-33020

CVE-2023-33020 corresponds to a transient denial-of-service in WLAN Hosts when an invalid channel (e.g., channel out of range) is received in STA during a Channel Switch Announcement (CSA) Information Element. The CVE is rated CVSS v3.1 base score 7.5 (HIGH) with NETWORK attack vector, LOW attack...

CVE-2023-33020 Improper Authorization in WLAN Host

Transient DOS in WLAN Host when an invalid channel like channel out of range is received in STA during CSA IE...

CVE-2023-21213

In initiateTdlsTeardownInternal of staiface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the wifi server with System execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2023-21209

In multiple functions of staiface.cpp, there is a possible out of bounds read due to unsafe deserialization. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

CVE-2023-21207

In initiateTdlsSetupInternal of staiface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android...

CVE-2023-21210

In initiateHs20IconQueryInternal of staiface.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2023-21203

In startWpsPbcInternal of staiface.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID...

PT-2023-18000 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a possible out of bounds read due to improper input validation in the initiateHs20IconQueryInternal function of sta iface.cpp. This could lead to local information disclosure wi...

State-Sponsored Hackers Target Middle Eastern and African Governments

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Persistent cyber-espionage attacks, targeting governmental entities in the Middle East and Africa, have been unleashed by a group known as CL-STA-0043. This group has employed unprecedented methods to...

SUSE CVE-2012-6712

In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta.c, which will cause at least memory corruption...

SUSE CVE-2014-2706

Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service system crash via network traffic that improperly interacts with the WLANSTAPSSTA state aka power-save mode, related to stainfo.c and tx.c...

PT-2023-35055 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.8 Description: The issue concerns the initialization of rx-link and rx-link sta in the mac80211 component of the wifi module. The actual impact and attack plausibility have not yet been proven...

GSD-2023-1000804 wifi: ath11k: fix firmware assert during bandwidth change for peer sta

wifi: ath11k: fix firmware assert during bandwidth change for peer sta This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...