In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames<\/p>\n
mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with
\nieee80211_amsdu_to_8023s() and walks the resulting subframes. For each
\nsubframe it passes the subframe data pointer to
\nmwifiex_process_tdls_action_frame(), but pairs it with skb->len, the
\nlength of the A-MSDU parent, instead of rx_skb->len:<\/p>\n
\trx_skb = __skb_dequeue(&list);
\n\trx_hdr = (struct rx_packet_hdr *)rx_skb->data;
\n\tif (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
\n\t ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) {
\n\t\tmwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr,
\n\t\t\t\t\t\t skb->len);
\n\t}<\/p>\n
The parent is not a valid description of that buffer, and may not be
\nvalid memory at all. ieee80211_amsdu_to_8023s() ends with<\/p>\n
\tif (!reuse_skb)
\n\t\tdev_kfree_skb(skb);<\/p>\n
and it only sets reuse_skb when the parent is linear, is not a
\nhead_frag, and is being consumed as the *last* subframe. So when the
\nparent does not qualify for reuse it has already been freed, and the
\nread of skb->len is a use-after-free. When it is reused, skb->len is
\nthe length of the last subframe, applied to every earlier subframe,
\nwhich over-states the buffer whenever an earlier subframe is shorter.<\/p>\n
The callee cannot absorb a wrong length, because it derives its own
\nceiling from the value it is given. Each frame type computes<\/p>\n
\ties_len = len – sizeof(struct ethhdr) – TDLS_*_FIX_LEN;<\/p>\n
and the element walk is then bounded entirely against that ceiling,<\/p>\n
\tfor (end = pos + ies_len; pos + 1 end)
\n\t\t\tbreak;<\/p>\n
so a too-large len moves end past the end of the subframe and the walk
\nreads and copies beyond it. The A-MSDU layout is chosen by the sender,
\nwhich makes the difference between the last subframe and a shorter
\nearlier one remotely selectable. Reaching this requires TDLS support in
\nfirmware and the TDLS ethertype on the subframe.<\/p>\n
The other caller, mwifiex_process_rx_packet(), is correct: it passes a
\npointer and a length that describe the same region of the RX buffer.<\/p>\n
Pass rx_skb->len, the length of the subframe actually being parsed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames<\/p>\n
mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with
\nieee<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-8760","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/8760","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8760"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8760"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8760"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}