diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2022-09-28 22:01:37 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2022-10-10 09:50:15 +0200 |
| commit | 8f033d2becc24aa6bfd2a5c104407963560caabc (patch) | |
| tree | 7a7675b9ccfa249d4798238cdbe7505973213b32 /net/phonet | |
| parent | wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() (diff) | |
| download | linux-8f033d2becc24aa6bfd2a5c104407963560caabc.tar.xz linux-8f033d2becc24aa6bfd2a5c104407963560caabc.zip | |
wifi: cfg80211/mac80211: reject bad MBSSID elements
Per spec, the maximum value for the MaxBSSID ('n') indicator is 8,
and the minimum is 1 since a multiple BSSID set with just one BSSID
doesn't make sense (the # of BSSIDs is limited by 2^n).
Limit this in the parsing in both cfg80211 and mac80211, rejecting
any elements with an invalid value.
This fixes potentially bad shifts in the processing of these inside
the cfg80211_gen_new_bssid() function later.
I found this during the investigation of CVE-2022-41674 fixed by the
previous patch.
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Fixes: 78ac51f81532 ("mac80211: support multi-bssid")
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/phonet')
0 files changed, 0 insertions, 0 deletions