The Linux kernel rtl8723bs staging driver contained a vulnerability in the OnAssocRsp() function where the IE parsing loop could read beyond the allocated receive buffer. This occurred because the loop advanced by (pIE->length + 2) bytes each iteration but only checked that the loop index was less than the packet length (pkt_len). A malicious access point could send an association response frame where the last IE's element_id byte was at pkt_len-1, causing the code to read pIE->length from one byte past the buffer. Additionally, the IE length field could specify a length extending beyond pkt_len, causing truncated IEs to be passed to handlers. The patch adds two guards: one to break the loop if fewer than the IE header bytes remain, and another to break if the IE's declared length extends beyond pkt_len, thus preventing OOB reads.

This vulnerability allows a malicious access point to cause out-of-bounds reads in the kernel memory when processing association response frames. Such OOB reads can lead to information disclosure or kernel memory corruption, potentially destabilizing the system or enabling further exploitation. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel rtl8723bs staging driver to add boundary checks preventing out-of-bounds reads in the OnAssocRsp() IE parsing loop. Users should update their Linux kernel to a version that includes this patch once available. Patch status is not yet confirmed from vendor advisory; check the official Linux kernel release notes or vendor advisories for the exact fixed version and apply updates accordingly.