Memory disclosure and service interruption via IE underflow

Integer underflow in the Linux kernel rtl8723bs driver allows adjacent attackers to read kernel memory and interrupt service via Wi-Fi frames. rtw_is_desired_network subtracts fixed WPS or beacon offsets from an untrusted network.ie_length before ensuring that the length reaches each offset, wrapping the unsigned parser length. An unauthenticated attacker must be within wireless range and advertise malformed information elements to a system using the staging rtl8723bs Wi-Fi driver; the oversized parse can read beyond the IE buffer or disrupt the host.