CVE-2017-11089

What it actually does

Buffer overread in nl80211_set_station handler triggered when NL80211_ATTR_LOCAL_MESH_POWER_MODE attribute carries fewer than 4 bytes of data, exposing adjacent kernel memory.

Why it matters to the business

Potential disclosure of sensitive kernel memory contents to remote or local attackers, increasing risk of further compromise on affected Android-based devices or systems using the vulnerable component.

How an attack unfolds

An attacker crafts a netlink message containing the NL80211_ATTR_LOCAL_MESH_POWER_MODE attribute with undersized data and sends it to the kernel, causing the overread during station configuration handling.

How to fix it

Upgrade resiprocate/resiprocate (GIT) to commit 2cb291191c93c7c4e371e22cb89805a5b31d6608 or later; apply vendor kernel patches addressing the nl80211 attribute size validation.

How to confirm the fix worked

Confirm presence of explicit length check (>=4 bytes) for NL80211_ATTR_LOCAL_MESH_POWER_MODE before use in nl80211_set_station; test with undersized attribute payloads in a lab environment.

Typical attack path

1. Establish netlink socket to the wireless subsystem
2. Construct NL80211_CMD_SET_STATION message with NL80211_ATTR_LOCAL_MESH_POWER_MODE attribute sized under 4 bytes
3. Transmit the malformed message to trigger the buffer overread
4. Capture leaked kernel memory from the response or side effects

How to detect it

Review netlink audit logs or wireless driver traces for SET_STATION commands carrying the MESH_POWER_MODE attribute; inspect for unusually small attribute lengths or unexpected memory disclosure patterns in responses.

What your security team should do

• Apply the referenced commit or equivalent kernel patch immediately given the age of the disclosure
• Restrict unprivileged access to netlink wireless configuration interfaces where feasible
• Monitor EPSS and exploit maturity indicators for any future increase in activity