CVE-2023-29468

Deeper analysis

The Texas Instruments WiLink WL18xx MCP driver in WILINK8-WIFI-MCP8 version 8.5_SP3 and earlier contains an unbounded parsing flaw for information elements of type XCC_EXT_1_IE_ID and XCC_EXT_2_IE_ID within 802.11 management frames. Because the driver performs no count or length validation on these elements before copying them into fixed-size buffers, a malformed frame can trigger a classic buffer overflow (CWE-120). The issue received a CVSS 3.1 score of 9.8, reflecting a network-reachable flaw with no required authentication or user interaction.

An unauthenticated attacker within radio range can transmit a single specially crafted management frame that overflows the stack or heap structures used by the driver. Successful exploitation can result in arbitrary code execution on the affected wireless subsystem, potentially compromising the host system that incorporates the WL18xx chipset.

The vendor advisory published at https://www.ti.com/lit/swra773 describes the affected driver versions and provides updated firmware and software packages that enforce proper IE limits during management-frame processing. Organizations using WILINK8-WIFI-MCP8 should apply the referenced patches or migrate to a corrected release to eliminate the overflow condition. The associated EPSS score of 0.58 indicates moderate but non-negligible exploitation interest since disclosure.