In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: ath6kl: fix OOB access from firmware ADDBA window size<\/p>\n
aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied
\nwin_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not
\nreturn. The out-of-range win_sz is then used in TID_WINDOW_SZ() to
\ncompute a kzalloc size and stored in rxtid->hold_q_sz, leading to
\nzero-size or overflowed allocations and subsequent out-of-bounds access.<\/p>\n
Clean up any previously active aggregation session for the TID first,
\nthen return early when win_sz is out of the valid range, instead of
\nproceeding with a broken allocation size.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: ath6kl: fix OOB access from firmware ADDBA window size<\/p>\n
aggr_recv_addba_req_evt() logs a debug message when the firmware-supp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5378","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5378","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5378"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5378"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5378"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}