CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the mt76 driver for the mt7996 Wi-Fi chip, allowing a malicious or malfunctioning device to exploit an unchecked EEPROM address, leading to potential out-of-bounds writes. This could result in data corruption or system instability, making it critical for organizations using affected Linux systems with mt7996 hardware to prioritize patching. Users should focus on updating their systems to mitigate the risk of exploitation from compromised devices.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data. Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.