In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: minstrel_ht: validate fixed rate index<\/p>\n
The fixed_rate_idx debugfs file is a plain u32 attribute, so any value
\ncan be written to it. minstrel_ht_update_stats() then copies the value
\ninto mi->max_tp_rate[] and mi->max_prob_rate, and
\nminstrel_ht_set_rate() uses MI_RATE_GROUP()\/MI_RATE_IDX() to index
\nminstrel_mcs_groups[] (42 entries) and mi->groups[].rates[] (10 entries)
\nwith it.<\/p>\n
Writing e.g. 65535 selects group 4095 and rate index 15, far outside
\nboth arrays. The out-of-bounds entries are dereferenced and updated as
\nstruct minstrel_rate_stats (retry counts, etc.), so the invalid index
\ncorrupts adjacent kernel memory. With CONFIG_UBSAN_BOUNDS the access is
\nreported as an array-index-out-of-bounds in minstrel_ht_set_rate().<\/p>\n
Only a valid group\/rate pair, or U32_MAX to disable fixed rate
\nprocessing, can be used safely, so reject any other value when the
\ndebugfs file is written.<\/p>\n
The file is only reachable through a root-only debugfs mount, so this is
\nnot a privilege boundary. The out-of-bounds access is still a bug that
\nmust not be reachable through a writable debugfs attribute.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: minstrel_ht: validate fixed rate index<\/p>\n
The fixed_rate_idx debugfs file is a plain u32 attribute, so any value
\ncan <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41175","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}