mirror of
https://github.com/coolsnowwolf/lede.git
synced 2025-04-16 04:13:31 +00:00
d05fbef769
* mac80211: backport security fixes
This mainly affects scanning and beacon parsing, especially with MBSSID enabled
Fixes: CVE-2022-41674
Fixes: CVE-2022-42719
Fixes: CVE-2022-42720
Fixes: CVE-2022-42721
Fixes: CVE-2022-42722
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 26f400210d6b3780fcc0deb89b9741837df9c8b8)
* mac80211: refresh patches
355-wifi-cfg80211-fix-BSS-refcounting-bugs.patch - 5a52384a51
Co-authored-by: Felix Fietkau <nbd@nbd.name>
Co-authored-by: 1054009064 <1054009064@users.noreply.github.com>
48 lines
1.7 KiB
Diff
48 lines
1.7 KiB
Diff
From: Johannes Berg <johannes.berg@intel.com>
|
|
Date: Wed, 28 Sep 2022 22:01:37 +0200
|
|
Subject: [PATCH] wifi: cfg80211/mac80211: reject bad MBSSID elements
|
|
|
|
commit 8f033d2becc24aa6bfd2a5c104407963560caabc upstream
|
|
|
|
Per spec, the maximum value for the MaxBSSID ('n') indicator is 8,
|
|
and the minimum is 1 since a multiple BSSID set with just one BSSID
|
|
doesn't make sense (the # of BSSIDs is limited by 2^n).
|
|
|
|
Limit this in the parsing in both cfg80211 and mac80211, rejecting
|
|
any elements with an invalid value.
|
|
|
|
This fixes potentially bad shifts in the processing of these inside
|
|
the cfg80211_gen_new_bssid() function later.
|
|
|
|
I found this during the investigation of CVE-2022-41674 fixed by the
|
|
previous patch.
|
|
|
|
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
|
|
Fixes: 78ac51f81532 ("mac80211: support multi-bssid")
|
|
Reviewed-by: Kees Cook <keescook@chromium.org>
|
|
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
---
|
|
|
|
--- a/net/mac80211/util.c
|
|
+++ b/net/mac80211/util.c
|
|
@@ -1413,6 +1413,8 @@ static size_t ieee802_11_find_bssid_prof
|
|
for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) {
|
|
if (elem->datalen < 2)
|
|
continue;
|
|
+ if (elem->data[0] < 1 || elem->data[0] > 8)
|
|
+ continue;
|
|
|
|
for_each_element(sub, elem->data + 1, elem->datalen - 1) {
|
|
u8 new_bssid[ETH_ALEN];
|
|
--- a/net/wireless/scan.c
|
|
+++ b/net/wireless/scan.c
|
|
@@ -2094,6 +2094,8 @@ static void cfg80211_parse_mbssid_data(s
|
|
for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) {
|
|
if (elem->datalen < 4)
|
|
continue;
|
|
+ if (elem->data[0] < 1 || (int)elem->data[0] > 8)
|
|
+ continue;
|
|
for_each_element(sub, elem->data + 1, elem->datalen - 1) {
|
|
u8 profile_len;
|
|
|