## https://sploitus.com/exploit?id=ABFAEEFB-1968-582C-B952-D826C4F537F8
# iwd 3.12 โ four Wi-Fi parser/handler bugs
Proof-of-concept code for four memory-safety and validation defects in
[iwd](https://git.kernel.org/pub/scm/network/wireless/iwd.git/) (iNet Wireless Daemon), the Wi-Fi
supplicant used on Linux desktops and embedded Linux images.
**Write-up:**
**Affected:** all four coexist in 1.30 through 3.12 (latest release, tag `d003d0e5`,
13 March 2026). They arrived separately โ FTE parser in 0.1, RRM in 1.1, `mde_equal()` in 1.14,
HE validator in 1.30 โ so older versions have a subset. No fix is upstream. As of publication `origin/master` is still `d003d0e5` and there is no tag
after 3.12.
No CVE IDs. Intel's bounty program closed the submission as out of scope; the maintainers
confirmed the findings but have not requested identifiers. Findings are numbered here.
## Findings
| # | Bug | Location | Class | Reachable | Directory |
|---|-----|----------|-------|-----------|-----------|
| 1 | RRM beacon report stack overflow | `src/rrm.c:334,370` | Stack buffer overflow (CWE-121) | Connected, no PMF required | [`01-rrm-stack-overflow/`](01-rrm-stack-overflow/) |
| 2 | HE Capabilities validator reads the wrong byte | `src/ie.c:2714` | OOB read (CWE-125) | Passive scan, pre-association | [`02-he-caps-oob-read/`](02-he-caps-oob-read/) |
| 3 | `mde_equal()` compares its first argument to itself | `src/ft.c:385` | Broken check (CWE-697) | FT roam | [`03-ft-mde-equal/`](03-ft-mde-equal/) |
| 4 | FTE sub-element length underflows a `uint8_t` | `src/ie.c:1919` | Integer underflow โ OOB read (CWE-191/125) | FT auth response, before MIC | [`04-fte-subelem-underflow/`](04-fte-subelem-underflow/) |
Finding 1 is the one that matters. The other three are included because they were reported and
patched together.
## Quick start
Each finding builds and runs standalone with a C compiler. No Wi-Fi hardware needed โ the
harnesses lift the vulnerable code verbatim out of iwd.
```bash
git clone https://github.com/abhinavagarwal07/iwd-security-poc
cd iwd-security-poc
(cd 01-rrm-stack-overflow/poc && ./run_poc.sh) # stack overflow, ASan + no-canary + canary builds
(cd 02-he-caps-oob-read/poc && ./run_poc.sh) # heap OOB read, ASan
(cd 03-ft-mde-equal/poc && ./run_poc.sh) # broken comparison, no sanitizer needed
(cd 04-fte-subelem-underflow/poc && ./run_poc.sh) # uint8_t underflow, ASan
```
Each run writes `poc/evidence/run__.log`. macOS/arm64 logs are committed for all four;
finding 2 also has a Linux/x86-64 log, and finding 1 has the ASan report from the real daemon.
Finding 1 also has:
- [`01-rrm-stack-overflow/e2e/`](01-rrm-stack-overflow/e2e/) โ end-to-end trigger against a real
iwd daemon over `mac80211_hwsim`. This is what produced the ASan crash in
[`poc/evidence/asan_real_iwd_x86_64.txt`](01-rrm-stack-overflow/poc/evidence/asan_real_iwd_x86_64.txt).
- [`01-rrm-stack-overflow/arm32-rce/`](01-rrm-stack-overflow/arm32-rce/) โ the same write loop in an
ARM32 frame with the register-save layout a no-canary build produces, hijacking `pc` through the
saved `lr`.
- [`01-rrm-stack-overflow/rop_analysis.md`](01-rrm-stack-overflow/rop_analysis.md) โ per-architecture
frame layouts, including why x86-64 is a dead end.
## Patches
One patch per finding, all verified with `git apply --check` against `d003d0e5`:
```
01-rrm-stack-overflow/patch_rrm.diff
02-he-caps-oob-read/patch_he_caps.diff
03-ft-mde-equal/patch_mde_equal.diff
04-fte-subelem-underflow/patch_fte.diff
```
They were sent to the maintainers on 2026-05-21 and confirmed on 2026-05-28. They are not upstream.
## Safety
Run in a disposable VM. The end-to-end harness loads `mac80211_hwsim`, starts `hostapd`, injects
frames, and kills the daemon under test. The standalone harnesses only corrupt their own stack, but
they are still deliberately memory-unsafe programs โ several are expected to abort partway through,
and that is the result, not a build error.
For security research and defensive testing. Don't point it at networks or devices you don't own.
## Timeline
| Date | Event |
|------|-------|
| 2026-05-12 | Reported to Intel via Intigriti. |
| 2026-05-19 | Reported to the iwd maintainers. |
| 2026-05-21 | Patches sent. |
| 2026-05-22 | Intigriti closed the submission as out of scope. |
| 2026-05-28 | Maintainers confirmed all four findings. |
| 2026-06-29 | Valve PSIRT notified โ SteamOS ships iwd as the default Wi-Fi backend. |
| 2026-07-21 | Told the maintainers I would publish by 27 July. |
| 2026-08-01 | This repo and the write-up published. Still no fix upstream. |
## License
`GPL-3.0-or-later`. The excerpts of iwd source embedded in the harnesses are LGPL-2.1-or-later,
ยฉ the iwd authors, reproduced for security research.