diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2022-09-28 22:01:37 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-10-15 07:55:55 +0200 |
| commit | e7aa7fd10eba32835de3dfa7f1691a90043faa73 (patch) | |
| tree | 6e9f75584d4355bb7a78957ed548edce8c4fb712 /net/wireless | |
| parent | a6408e0b694c1bdd8ae7dd0464a86b98518145ec (diff) | |
| download | linux-e7aa7fd10eba32835de3dfa7f1691a90043faa73.tar.gz linux-e7aa7fd10eba32835de3dfa7f1691a90043faa73.tar.bz2 linux-e7aa7fd10eba32835de3dfa7f1691a90043faa73.zip | |
wifi: cfg80211/mac80211: reject bad MBSSID elements
commit 8f033d2becc24aa6bfd2a5c104407963560caabc upstream.
Per spec, the maximum value for the MaxBSSID ('n') indicator is 8,
and the minimum is 1 since a multiple BSSID set with just one BSSID
doesn't make sense (the # of BSSIDs is limited by 2^n).
Limit this in the parsing in both cfg80211 and mac80211, rejecting
any elements with an invalid value.
This fixes potentially bad shifts in the processing of these inside
the cfg80211_gen_new_bssid() function later.
I found this during the investigation of CVE-2022-41674 fixed by the
previous patch.
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Fixes: 78ac51f81532 ("mac80211: support multi-bssid")
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/scan.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/wireless/scan.c b/net/wireless/scan.c index ccbaaa7bb4f7..a5dc69e833ea 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -2093,6 +2093,8 @@ static void cfg80211_parse_mbssid_data(struct wiphy *wiphy, for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) { if (elem->datalen < 4) continue; + if (elem->data[0] < 1 || (int)elem->data[0] > 8) + continue; for_each_element(sub, elem->data + 1, elem->datalen - 1) { u8 profile_len; |