In a background process called iwd, utilized to connect Linux systems to wireless networks, a vulnerability has been identified, leading to a buffer overflow when processing a specific wireless request (802.11k) that does not require authentication on networks with WPA2 without PMF. A prototype exploit for this vulnerability is available.
The vulnerability stems from a fixed buffer overflow uint8_t frame[512] when parsing RRM (Radio Report Measurement) frames in the rrm_report_beacon_results() function. This issue affects iwd versions ranging from 1.30 to 3.12. A third-party patch addressing this vulnerability has been developed, but it has not been incorporated into the main iwd codebase yet.
/Reports, release notes, official announcements.