Threats tagged 'ghsa-3mp2-v334-gxv5'

A vulnerability in the Linux kernel's wifi driver (rsi) was resolved that involved improper handling of TKIP MIC keys. The function rsi_hal_load_key() copied MIC keys unconditionally from fixed offsets assuming a 32-byte TKIP key layout, which caused out-of-bounds reads when shorter keys from other ciphers like CCMP were used. The fix ensures MIC keys are only copied for TKIP and rejects malformed TKIP keys shorter than 32 bytes.