In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled<\/p>\n
When the TLC notification disables AMSDU for a TID, the MLD driver sets
\nmax_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in
\niwl_mld_tx_tso_segment() checks for zero but not for this sentinel,
\nallowing it to reach the num_subframes calculation:<\/p>\n
num_subframes = (max_tid_amsdu_len + pad) \/ (subf_len + pad)
\n = (1 + 2) \/ (1534 + 2) = 0<\/p>\n
This zero propagates to iwl_tx_tso_segment() which sets:<\/p>\n
gso_size = num_subframes * mss = 0<\/p>\n
Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny
\nsegments from a single GSO skb. This floods the TX ring with ~1024
\nmicro-frames (the rest are purged), creating a massive burst of TX
\ncompletion events that can lead to memory corruption and a subsequent
\nuse-after-free in TCP’s retransmit queue (refcount underflow in
\ntcp_shifted_skb, NULL deref in tcp_rack_detect_loss).<\/p>\n
The MVM driver is immune because it checks mvmsta->amsdu_enabled before
\nreaching the num_subframes calculation. The MLD driver has no equivalent
\nbitmap check and relies solely on max_tid_amsdu_len, which does not
\ncatch the sentinel value.<\/p>\n
Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the
\nexisting check and falling back to non-AMSDU TSO segmentation. Also add
\na WARN_ON_ONCE guard after the num_subframes division as defense-in-depth
\nto catch any future code paths that produce zero through a different
\nmechanism.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled<\/p>\n
When the TLC notification disables AMSDU for a TID, the <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15029","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15029","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15029"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15029"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15029"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}