In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: wilc1000: fix out-of-bounds read in P2P public action frames<\/p>\n
wilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once
\nieee80211_is_public_action() returns true. That helper only verifies the
\nframe is long enough for the action category field, that is
\noffsetofend(struct ieee80211_mgmt, u.action.category), 25 bytes. Both
\nfunctions then read the P2P public action header up to oui_subtype at
\noffset 30 and pass “size – ie_offset” to cfg80211_find_vendor_ie(), where
\nie_offset is offsetof(struct ieee80211_mgmt, u) + sizeof(*d), i.e. 32.<\/p>\n
A public action frame of 25 to 31 bytes passes the check but is shorter
\nthan that 32 byte header, so oui_subtype can be read out of bounds, and
\nbecause the length is unsigned, “size – ie_offset” underflows to a value
\nclose to 4 GiB. cfg80211_find_vendor_ie() takes an unsigned int length,
\nso even the size_t subtraction in mgmt_tx() is truncated to the same
\nvalue. It then walks far past the buffer searching for a vendor element
\nuntil it reaches unmapped memory.<\/p>\n
In the receive path the frame arrives over the air and needs no
\nassociation, so a nearby unauthenticated device can crash the host while
\nit is in P2P listen. Reject frames shorter than the P2P public action
\nheader in both paths before dereferencing it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: wilc1000: fix out-of-bounds read in P2P public action frames<\/p>\n
wilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once
\nieee<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33259","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33259","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33259"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33259"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33259"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}