In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: validate TX status rate metadata<\/p>\n
minstrel_ht_tx_status() converts the HT\/VHT rate reported in a TX status
\ninto a group and rate index and uses those to index the minstrel_ht rate
\ntables. The existing validation only checked that an entry was present
\nand had tries recorded; it did not check that the reported MCS, spatial
\nstream count and bandwidth are representable by the tables, so malformed
\nmetadata passed to minstrel_ht_get_stats() or
\nminstrel_ht_ri_get_stats() could be used as an out-of-bounds index.<\/p>\n
Validate the rate metadata in the common TX status path instead of only
\nin minstrel_ht, since the values are used by more than rate control.
\nThe legacy ieee80211_tx_rate array and the rate_info based entries are
\nsanitized in ieee80211_tx_status_ext() and ieee80211_tx_rate_update()
\nbefore any consumer runs: an entry that does not describe a valid rate
\nfor its encoding is dropped. minstrel_ht keeps the checks that depend
\non its own tables, i.e. the supported number of spatial streams, the MCS
\ngroup size and the supported bandwidths.<\/p>\n
This does not take away the driver’s responsibility to report sane
\nvalues, it only prevents a single bad report from corrupting mac80211
\nstate. No WARN_ON() is added: with panic_on_warn a driver bug would
\notherwise turn into a denial of service.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: validate TX status rate metadata<\/p>\n
minstrel_ht_tx_status() converts the HT\/VHT rate reported in a TX status
\ninto a g<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41296","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41296","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41296"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41296"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41296"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}