diff options
| author |  Johannes Berg <johannes.berg@intel.com>
| 2022-09-28 22:07:15 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com>
| 2022-10-10 09:50:23 +0200 |
| commit | ff05d4b45dd89b922578dac497dcabf57cf771c6 (patch) | |
| tree | b67ee15aea80b40cc40d2d76058b744deb3b080c /net/mac80211/ieee80211_i.h | |
| parent | wifi: cfg80211/mac80211: reject bad MBSSID elements (diff) | |
| download | linux-ff05d4b45dd89b922578dac497dcabf57cf771c6.tar.gz linux-ff05d4b45dd89b922578dac497dcabf57cf771c6.tar.bz2 linux-ff05d4b45dd89b922578dac497dcabf57cf771c6.zip | |
wifi: mac80211: fix MBSSID parsing use-after-free
When we parse a multi-BSSID element, we might point some
element pointers into the allocated nontransmitted_profile.
However, we free this before returning, causing UAF when the
relevant pointers in the parsed elements are accessed.
Fix this by not allocating the scratch buffer separately but
as part of the returned structure instead, that way, there
are no lifetime issues with it.
The scratch buffer introduction as part of the returned data
here is taken from MLO feature work done by Ilan.
This fixes CVE-2022-42719.
Fixes: 5023b14cf4df ("mac80211: support profile split between elements")
Co-developed-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/mac80211/ieee80211_i.h')
| -rw-r--r-- | net/mac80211/ieee80211_i.h | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index 4e1d4c339f2d..a842f2e1c230 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -1709,6 +1709,14 @@ struct ieee802_11_elems { /* whether a parse error occurred while retrieving these elements */ bool parse_error; + + /* + * scratch buffer that can be used for various element parsing related + * tasks, e.g., element de-fragmentation etc. + */ + size_t scratch_len; + u8 *scratch_pos; + u8 scratch[]; }; static inline struct ieee80211_local *hw_to_local( |