libipw MichaelMic OOB

Vulnerability analysis

The TKIP Michael MIC verification routine in the Intel ipw2x00 WiFi driver assumes every received TKIP frame contains an eight-byte MIC trailer. When a frame shorter than the header plus eight bytes arrives, the unsigned payload-length calculation underflows to a very large value, causing the MIC computation function to read far past the end of the packet buffer—leaking kernel memory or triggering a page fault panic. The fix adds a length check that rejects frames too short to contain a MIC before any processing begins, and replaces the hardcoded size constant throughout the function. The vulnerable code path is reached whenever the driver processes an incoming TKIP-encrypted WiFi frame, so any unauthenticated attacker within wireless range of a device using the ipw2x00 driver can trigger the bug by transmitting a crafted short frame.