lkml.org 
[lkml]   [2022]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 26/34] wifi: cfg80211: avoid nontransmitted BSS list corruption
    Date
    From: Johannes Berg <johannes.berg@intel.com>

    commit bcca852027e5878aec911a347407ecc88d6fff7f upstream.

    If a non-transmitted BSS shares enough information (both
    SSID and BSSID!) with another non-transmitted BSS of a
    different AP, then we can find and update it, and then
    try to add it to the non-transmitted BSS list. We do a
    search for it on the transmitted BSS, but if it's not
    there (but belongs to another transmitted BSS), the list
    gets corrupted.

    Since this is an erroneous situation, simply fail the
    list insertion in this case and free the non-transmitted
    BSS.

    This fixes CVE-2022-42721.

    Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
    Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
    Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/wireless/scan.c | 9 +++++++++
    1 file changed, 9 insertions(+)

    --- a/net/wireless/scan.c
    +++ b/net/wireless/scan.c
    @@ -423,6 +423,15 @@ cfg80211_add_nontrans_list(struct cfg802

    rcu_read_unlock();

    + /*
    + * This is a bit weird - it's not on the list, but already on another
    + * one! The only way that could happen is if there's some BSSID/SSID
    + * shared by multiple APs in their multi-BSSID profiles, potentially
    + * with hidden SSID mixed in ... ignore it.
    + */
    + if (!list_empty(&nontrans_bss->nontrans_list))
    + return -EINVAL;
    +
    /* add to the list */
    list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
    return 0;

    \
     
     \ /
      Last update: 2022-10-13 20:12    [W:2.727 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site