github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-05 21:15:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
31ce5da48a
linux/net/mac80211
History
Johannes Berg 31ce5da48a wifi: mac80211: fix MBSSID parsing use-after-free 
Commit ff05d4b45d upstream.
This is a different version of the commit, changed to store
the non-transmitted profile in the elems, and freeing it in
the few places where it's relevant, since that is only the
case when the last argument for parsing (the non-tx BSSID)
is non-NULL.

When we parse a multi-BSSID element, we might point some
element pointers into the allocated nontransmitted_profile.
However, we free this before returning, causing UAF when the
relevant pointers in the parsed elements are accessed.

Fix this by not allocating the scratch buffer separately but
as part of the returned structure instead, that way, there
are no lifetime issues with it.

The scratch buffer introduction as part of the returned data
here is taken from MLO feature work done by Ilan.

This fixes CVE-2022-42719.

Fixes: 5023b14cf4 ("mac80211: support profile split between elements")
Co-developed-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-17 17:26:07 +02:00
..
aead_api.c mac80211: Check crypto_aead_encrypt for errors 2021-04-10 13:36:08 +02:00
aead_api.h
aes_ccm.h
aes_cmac.c mac80211: Update BIP to support Beacon frames 2020-02-24 10:36:03 +01:00
aes_cmac.h
aes_gcm.h
aes_gmac.c mac80211: Check crypto_aead_encrypt for errors 2021-04-10 13:36:08 +02:00
aes_gmac.h
agg-rx.c mac80211: fix lookup when adding AddBA extension element 2021-12-22 09:30:54 +01:00
agg-tx.c mac80211: refuse aggregations sessions before authorized 2022-03-19 13:44:44 +01:00
airtime.c mac80211: add AQL support for VHT160 tx rates 2020-09-18 11:36:03 +02:00
cfg.c mac80211: fix potential double free on mesh join 2022-03-28 09:57:10 +02:00
chan.c wifi: mac80211: fix use-after-free in chanctx code 2022-06-09 10:21:22 +02:00
debug.h
debugfs_key.c mac80211: Support BIGTK configuration for Beacon protection 2020-02-24 10:35:57 +01:00
debugfs_key.h mac80211: Support BIGTK configuration for Beacon protection 2020-02-24 10:35:57 +01:00
debugfs_netdev.c cfg80211/mac80211: add connected to auth server to meshconf 2020-07-31 09:24:24 +02:00
debugfs_netdev.h
debugfs_sta.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2020-03-29 21:25:29 -07:00
debugfs_sta.h
debugfs.c mac80211: fix incorrect strlen of .write in debugfs 2021-02-07 15:37:15 +01:00
debugfs.h
driver-ops.c mac80211: fix station rate table updates on assoc 2021-02-10 09:29:16 +01:00
driver-ops.h mac80211: mark TX-during-stop for TX in in_reconfig 2021-12-22 09:30:50 +01:00
ethtool.c
fils_aead.c
fils_aead.h
he.c mac80211: use HE 6 GHz band capability and pass it to the driver 2020-05-31 11:27:03 +02:00
ht.c mac80211: Use fallthrough pseudo-keyword 2020-07-31 09:24:23 +02:00
ibss.c wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected 2022-09-08 11:11:40 +02:00
ieee80211_i.h wifi: mac80211: fix MBSSID parsing use-after-free 2022-10-17 17:26:07 +02:00
iface.c mac80211: Fix monitor MTU limit so that A-MSDUs get through 2021-09-18 13:40:28 +02:00
Kconfig ath9k: fix build error with LEDS_CLASS=m 2021-02-17 11:02:25 +01:00
key.c mac80211: prevent mixed key and fragment cache attacks 2021-06-03 09:00:29 +02:00
key.h mac80211: prevent mixed key and fragment cache attacks 2021-06-03 09:00:29 +02:00
led.c
led.h
main.c mac80211: bail out if cipher schemes are invalid 2021-05-14 09:50:34 +02:00
Makefile mac80211: initialize last_rate for S1G STAs 2020-10-08 10:40:57 +02:00
mesh_hwmp.c mac80211: fix potential overflow when multiplying to u32 integers 2021-03-04 11:37:32 +01:00
mesh_pathtbl.c mac80211: check return value of rhashtable_init 2021-10-17 10:43:33 +02:00
mesh_plink.c mac80211: fix some more kernel-doc in mesh 2020-09-28 14:36:53 +02:00
mesh_ps.c mac80211: mesh: fix potentially unaligned access 2021-10-06 15:55:52 +02:00
mesh_sync.c
mesh.c mac80211: rename csa counters to countdown counters 2020-08-27 14:12:15 +02:00
mesh.h mac80211: add HE 6 GHz Band Capability element 2020-05-31 11:26:39 +02:00
michael.c
michael.h
mlme.c wifi: mac80211: fix MBSSID parsing use-after-free 2022-10-17 17:26:07 +02:00
ocb.c
offchannel.c mac80211: Inform AP when returning operating channel 2020-09-28 13:18:53 +02:00
pm.c
rate.c mac80211: fix station rate table updates on assoc 2021-02-10 09:29:16 +01:00
rate.h mac80211: populate debugfs only after cfg80211 init 2020-04-24 11:30:13 +02:00
rc80211_minstrel_debugfs.c
rc80211_minstrel_ht_debugfs.c
rc80211_minstrel_ht.c One batch of changes, containing: 2020-05-26 20:17:35 -07:00
rc80211_minstrel_ht.h
rc80211_minstrel.c mac80211: minstrel: fix tx status processing corner case 2020-11-12 11:25:09 +01:00
rc80211_minstrel.h mac80211: minstrel: remove deferred sampling code 2020-11-12 11:24:43 +01:00
rx.c wifi: mac80211: fix crash in beacon protection for P2P-device 2022-10-15 07:55:56 +02:00
s1g.c mac80211: initialize last_rate for S1G STAs 2020-10-08 10:40:57 +02:00
scan.c wifi: mac80211: fix MBSSID parsing use-after-free 2022-10-17 17:26:07 +02:00
spectmgmt.c mac80211: 160MHz with extended NSS BW in CSA 2021-02-13 13:55:04 +01:00
sta_info.c net: Use u64_stats_fetch_begin_irq() for stats fetch. 2022-09-08 11:11:40 +02:00
sta_info.h mac80211: fix regression in SSN handling of addba tx 2021-12-22 09:30:50 +01:00
status.c mac80211: fix memory leak on filtered powersave frames 2020-11-12 11:23:58 +01:00
tdls.c mac80211: Use fallthrough pseudo-keyword 2020-07-31 09:24:23 +02:00
tkip.c
tkip.h
trace_msg.h
trace.c
trace.h mac80211: notify the driver when a sta uses 4-address mode 2020-09-18 12:16:16 +02:00
tx.c mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap 2021-10-06 15:55:51 +02:00
util.c wifi: mac80211: fix MBSSID parsing use-after-free 2022-10-17 17:26:07 +02:00
vht.c mac80211: don't set set TDLS STA bandwidth wider than possible 2020-12-30 11:53:50 +01:00
wep.c mac80211: make ieee80211_wep_init() return void 2020-02-07 12:40:34 +01:00
wep.h mac80211: make ieee80211_wep_init() return void 2020-02-07 12:40:34 +01:00
wme.c wifi: mac80211: fix queue selection for mesh/OCB interfaces 2022-07-21 21:20:00 +02:00
wme.h
wpa.c mac80211: fix use-after-free in CCMP/GCMP RX 2021-10-06 15:55:48 +02:00
wpa.h