In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mwifiex: Detach sync cmd buffer on interrupted wait<\/p>\n
mwifiex synchronous commands keep the caller-provided data buffer in
\ncmd_node->data_buf. Several callers pass stack-allocated objects there.<\/p>\n
If wait_event_interruptible_timeout() is interrupted, the caller can
\nreturn and release that stack object while the firmware command is still
\nthe current command. A late firmware response then reaches the normal
\nresponse handler, which can copy data through cmd_node->data_buf into the
\nstale stack address.<\/p>\n
This fixes a stack corruption observed during repeated association and
\ndisassociation cycles. The panic trace showed the command wait being
\ninterrupted immediately before a bad pointer dereference:<\/p>\n
cmd_wait_q terminated: -512
\n Unable to handle kernel paging request at virtual address 002c583837384662
\n Kernel panic – not syncing: stack-protector: Kernel stack is corrupted
\n …
\n Tainted: [M]=MACHINE_CHECK<\/p>\n
The fault address decodes as little-endian ASCII:<\/p>\n
0x002c583837384662 -> “bF878X,”<\/p>\n
which is a fragment of the VERSION_EXT firmware string exposed as
\ndebugfs “verext”:<\/p>\n
w8997o-V4, RF878X, FP92, 16.92.21.p153.7<\/p>\n
The same runs also showed corrupted control data containing:<\/p>\n
0x2400372e333531 -> “153.7$”<\/p>\n
which is the tail of the same VERSION_EXT string. This points at a late
\nVERSION_EXT response writing through a stale stack-backed data_buf after
\nthe interrupted wait returned.<\/p>\n
After cancelling pending commands on an interrupted or timed-out wait,
\ndetach the caller-owned data buffer from the still-current command. This
\npreserves the existing command cancellation behaviour while preventing a
\nlate response from writing through a pointer whose lifetime ended with the
\nwaiting caller.<\/p>\n
Tested on an i.MX8MP board using an 88W8997.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mwifiex: Detach sync cmd buffer on interrupted wait<\/p>\n
mwifiex synchronous commands keep the caller-provided data buffer in
\ncmd<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21277","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21277","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21277"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}