The Linux kernel rtl8723bs staging driver had two vulnerabilities in the OnAuth() function's shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() was called without verifying the frame length, leading to a length underflow and an out-of-bounds read in crc32_le(). Additionally, during processing of a seq=3 response, rtw_get_ie() stored the Challenge Text IE length but memcmp() read a fixed 128 bytes regardless of the actual length, violating IEEE 802.11 standards and causing an out-of-bounds read. The fixes add minimum length checks before accessing the IV field and enforce strict length validation on the Challenge Text IE.

These vulnerabilities can cause out-of-bounds reads in kernel memory during WEP decryption and Challenge Text IE processing, potentially leading to kernel crashes or information disclosure. The issues affect the shared-key authentication path in the rtl8723bs driver, which could impact devices using this driver for wireless connectivity.

A fix has been applied to the Linux kernel rtl8723bs staging driver to address these vulnerabilities by adding proper length checks. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for the exact fixed version and update accordingly.