In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: brcmfmac: cyw: fix heap overflow on a short auth frame<\/p>\n
brcmf_notify_auth_frame_rx() takes the frame length from the firmware
\nevent and copies the frame body with the management header offset
\nsubtracted:<\/p>\n
\tu32 mgmt_frame_len = e->datalen – sizeof(struct brcmf_rx_mgmt_data);
\n\t…
\n\tmemcpy(&mgmt_frame->u, frame,
\n\t mgmt_frame_len – offsetof(struct ieee80211_mgmt, u));<\/p>\n
The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len
\ncan be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When
\nmgmt_frame_len is below that, the subtraction wraps as an unsigned value to
\na huge length. The memcpy then runs far past the kzalloc’d buffer. A
\nmalicious or malfunctioning AP can make the frame short during the
\nexternal SAE auth exchange, so this is a remotely triggered heap overflow.<\/p>\n
Reject frames shorter than the management header offset before the copy.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: brcmfmac: cyw: fix heap overflow on a short auth frame<\/p>\n
brcmf_notify_auth_frame_rx() takes the frame length from the firmware<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6725","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}