CVE-2020-9395: 
WordPress vulnerability analysis and mitigation

A critical stack-based buffer overflow vulnerability (CVE-2020-9395) was discovered in Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before version 2.0.6. The vulnerability affects the client code responsible for handling WPA2's 4-way-handshake through malformed EAPOL-Key packets with long keydata buffers (NVD, CVE).

The vulnerability exists in the WPA2 handshake mechanism where the CheckMIC() function performs an unsafe memory copy operation. The function copies attacker-controlled data (EAPOLMsgRecvd.Octet and EAPOLMsgRecvd.Length) into a fixed-size stack buffer (tmpbuf) of 512 bytes. An attacker can send a packet larger than the buffer size, causing a stack overflow. The vulnerability is particularly severe as there are no mitigating factors in place, such as stack canaries, ASLR, or non-executable stack protection, making exploitation trivial (JFrog Blog).

Successful exploitation of this vulnerability allows an attacker in proximity to completely take over the Wi-Fi module and gain root access to the device's wireless communications. This affects embedded devices used across multiple industries including agriculture, automotive, energy, gaming, healthcare, industrial, and security sectors (SecurityWeek).

The vulnerability can be exploited remotely by an attacker in the proximity of an RTL8195 module without requiring knowledge of the Wi-Fi network password (PSK). The exploit works regardless of whether the module is operating as a Wi-Fi access point or client. For client devices, attackers can exploit by sniffing Wi-Fi packets to identify the target network's SSID, creating a malicious access point with the same SSID, and sending a deauth packet to force the victim device to connect to the malicious AP (JFrog Blog).

Realtek has released patches for this vulnerability. Devices built after March 3, 2020, are patched against CVE-2020-9395. The fix is included in Ameba Arduino version 2.0.6 and later releases. For RTL8195AM Arduino SDK, the complete patch is available in version V2.0.10-v5, built on September 7, 2021 (Ameba Security).