In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback<\/p>\n
ath12k_mac_vdev_create() for an AP vdev creates the bss self-peer via
\nath12k_peer_create(), which finishes by calling
\nath12k_dp_link_peer_assign() to publish the dp_link_peer in the
\ndp_hw->dp_peers[peerid_index] RCU table, in the dp_peer’s
\nlink_peers[] array, and in the per-addr rhashtable.<\/p>\n
If a step after ath12k_peer_create() fails the function jumps to
\nerr_peer_del, which open-codes a WMI peer_delete and waits for the
\nunmap \/ delete_resp events. The wait_for_peer_delete_done() path
\nrelies on ath12k_dp_link_peer_unmap_event() freeing the dp_link_peer
\nwhen the unmap arrives, but err_peer_del never calls
\nath12k_dp_link_peer_unassign() first. The published references in
\nthe dp_hw RCU table, dp_peer->link_peers[] and the rhashtable are
\nleft pointing at the dp_link_peer that unmap_event then frees,
\nproducing dangling pointers and use-after-free on subsequent
\nlookups.<\/p>\n
Replace the open-coded sequence with a call to ath12k_peer_delete(),
\nwhich already does ath12k_dp_link_peer_unassign() before sending the
\nWMI command. This drops the published references before the
\ndp_link_peer is freed, in the same order as the normal teardown path
\nin ath12k_mac_remove_link_interface().<\/p>\n
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback<\/p>\n
ath12k_mac_vdev_create() for an AP vdev creates the bss sel<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25951","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}