In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()<\/p>\n
ieee80211_monitor_select_queue() validates the skb length using skb->len
\nbefore dereferencing pointers into skb->data to access the 802.11 header.
\nHowever, skb->len includes data in both the linear head buffer and
\nnon-linear fragments\/pages. When AF_PACKET sends a packet large enough to
\nbecome non-linear, the 802.11 header at skb->data + len_rthdr may extend
\npast the linear head buffer even though skb->len appears sufficient.<\/p>\n
This leads to a slab-out-of-bounds read when accessing hdr->frame_control,
\nas the kernel reads beyond the allocated skb head buffer:<\/p>\n
BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x1ed\/0x220<\/p>\n
syzbot has hit the same issues.<\/p>\n
Fix this by checking skb_headlen(skb) (which gives the length of the
\nlinear data region) instead of skb->len before dereferencing skb->data
\npointers. This ensures the required bytes are actually present in the
\nlinear portion of the skb.<\/p>\n
Apply the same fix to ieee80211_validate_radiotap_len() which has the
\nsame class of bug: it uses skb->len to validate accesses to skb->data,
\nand to the corresponding checks in ieee80211_monitor_start_xmit(): for
\ndrivers advertising NETIF_F_SG the skb is not linearized before
\nndo_start_xmit, so the 802.11 header can be read past the linear
\nbuffer there as well.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()<\/p>\n
ieee80211_monitor_select_queue() validates the skb<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41282","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}