Posted by Ron E on Aug 26 The Realtek in-band ioctl bridge contains a heap-buffer overflow when

processing peer-supplied ioctl response data.

inband_ioctl() receives a response through the Realtek in-band transport

and extracts a 32-bit data_get_len value from that response. For several

wireless "get" operations, this peer-controlled value is subsequently used

directly as the length argument to memcpy().

For SIOCGIWSCAN, the destination is a caller-provided...