Acknowledged
Created: Jul 4, 2025
Updated: Jul 8, 2025
Found In Version: 10.22.33.1
Severity: Standard
Applicable for: Wind River Linux LTS 22
Component/s: Kernel
In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds[EOL][EOL]Set the size to 6 instead of 2, since 'para' array is passed to[EOL]'rtw_fw_bt_wifi_control(rtwdev, para[0], ¶[1])', which reads[EOL]5 bytes:[EOL][EOL]void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)[EOL]{[EOL] ...[EOL] SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);[EOL] SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));[EOL] ...[EOL] SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));[EOL][EOL]Detected using the static analysis tool - Svace.
CREATE(Triage):(User=lchen-cn) [CVE-2025-38159 (https://nvd.nist.gov/vuln/detail/CVE-2025-38159)
