In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: cfg80211: bound element ID read when checking non-inheritance<\/p>\n
cfg80211_is_element_inherited() reads the first data octet of the
\ncandidate element (id = elem->data[0]) to look it up in an extension
\nnon-inheritance list. It does so after testing elem->id, but without
\nverifying that the element actually has a data octet. A zero-length
\nextension element (WLAN_EID_EXTENSION with length 0) therefore makes it
\nread one octet past the end of the element.<\/p>\n
_ieee802_11_parse_elems_full() runs this check for every element of a
\nframe once a non-inheritance context exists — e.g. while parsing a
\nper-STA profile of a Multi-Link element in a (re)association response,
\nor a non-transmitted BSS profile — so a crafted frame from an AP can
\ntrigger a one-octet slab-out-of-bounds read during element parsing:<\/p>\n
BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited
\n Read of size 1 … in net\/wireless\/scan.c<\/p>\n
Return early (treat the element as inherited) when an extension element
\ncarries no data, mirroring the existing handling of empty ID lists.<\/p>\n
The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: cfg80211: bound element ID read when checking non-inheritance<\/p>\n
cfg80211_is_element_inherited() reads the first data octet of <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5464","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}