The Linux kernel rtl8723bs driver had a vulnerability in its WEP shared-key authentication handler where the length of the challenge-text element was not properly validated. The handler used the length returned by rtw_get_ie(), which could be up to 255 bytes, to memcpy data into a fixed 128-byte buffer (pmlmeinfo->chg_txt). This allowed a malicious access point to send a WLAN_EID_CHALLENGE element with a length exceeding 128 bytes, causing a buffer overflow of up to 127 bytes, or a shorter length causing stale memory to be echoed. The vulnerability is reachable over the air before association during shared-key authentication. The fix requires the challenge-text element length to be exactly 128 bytes as defined by WLAN_AUTH_CHALLENGE_LEN.

An attacker controlling a malicious access point could exploit this vulnerability to cause out-of-bounds memory writes or leak stale memory from the driver buffer during the WEP shared-key authentication process. This occurs before association, potentially allowing remote exploitation over the air. The impact includes possible memory corruption in the kernel driver, which could lead to denial of service or other undefined behavior. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel rtl8723bs driver by enforcing strict length checks on the challenge-text element. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel driver vulnerability, applying the official kernel update or patch from the vendor is the recommended mitigation. Patch status is not explicitly confirmed in the provided data; users should consult the Linux kernel vendor advisory for the exact fixed versions and update accordingly.