Realtek edimax 52fc10d19 In-Band Ioctl Response Length Confusion Causes Heap Buffer Overflow

Posted by Ron E on Aug 26The Realtek in-band ioctl bridge contains a heap-buffer overflow when processing peer-supplied ioctl response data. inband_ioctl() receives a response through the Realtek in-band transport and extracts a 32-bit data_get_len value from that response. For several wireless "get" operations, this peer-controlled value is...