A Linux kernel driver for wireless adapters based on Realtek chips vulnerability (), which could potentially be exploited to execute code in the kernel context by sending specially crafted frames.
The vulnerability is caused by a buffer overflow in the implementation code for the P2P mode (Wifi-Direct). During frame parsing (Notice of Absence) there is no size check for one of the values, allowing a write of data to an area outside the buffer and overwrite information in the following structures in the kernel.
An attack can be carried out by sending specially crafted frames to a system with an active network adapter based on a Realtek chip supporting , which allows two wireless adapters to connect directly without an access point. No connection to the attacker's wireless network is needed to exploit the issue, nor are any actions required from the user; it is sufficient for the attacker to be within the range of the wireless signal.
The working prototype of the exploit is currently limited to remotely triggering a kernel crash, but the vulnerability potentially allows for code execution (this assumption is still theoretical, as there is currently no prototype exploit for code execution, but the researcher who identified the issue is already working on its creation).
The problem arises starting from the kernel (according to other sources, the problem arises starting from the kernel ), released in 2013. A fix is currently only available in the form of . In distributions, the problem remains unresolved.
You can track the resolution of vulnerabilities in distributions on the following pages: , , , , , . The vulnerability also likely affects and the Android platform.
Forrás: opennet.ru
