In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb<\/p>\n
ieee80211_invoke_fast_rx() reads RX status through
\nIEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage
\nthat ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the
\nunicast forward path, mesh_data does:<\/p>\n
\tinfo = IEEE80211_SKB_CB(fwd_skb);
\n\tmemset(info, 0, sizeof(*info));<\/p>\n
on the same skb the caller still names via rx->skb, then either
\nqueues the skb for TX (success) or kfree_skb()’s it (no-route)
\nbefore returning RX_QUEUED. The caller’s RX_QUEUED arm then
\ncalls sta_stats_encode_rate(status) on memory that is either
\nzeroed (success path) or freed (no-route path). The latter is
\nKASAN slab-use-after-free in ieee80211_prepare_and_rx_handle.<\/p>\n
Fix by encoding the rate from status before invoking
\nieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value
\ncaptured while status was still backed by valid memory.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb<\/p>\n
ieee80211_invoke_fast_rx() reads RX status through
\nIEEE80211_SKB_R<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15086","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15086","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15086"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15086"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15086"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}