This is a note to let you know that I've just added the patch titled
wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans()
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
wifi-cfg80211-fix-u8-overflow-in-cfg80211_update_notlisted_nontrans.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From aebe9f4639b13a1f4e9a6b42cdd2e38c617b442d Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@xxxxxxxxx>
Date: Wed, 28 Sep 2022 21:56:15 +0200
Subject: wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans()
From: Johannes Berg <johannes.berg@xxxxxxxxx>
commit aebe9f4639b13a1f4e9a6b42cdd2e38c617b442d upstream.
In the copy code of the elements, we do the following calculation
to reach the end of the MBSSID element:
/* copy the IEs after MBSSID */
cpy_len = mbssid[1] + 2;
This looks fine, however, cpy_len is a u8, the same as mbssid[1],
so the addition of two can overflow. In this case the subsequent
memcpy() will overflow the allocated buffer, since it copies 256
bytes too much due to the way the allocation and memcpy() sizes
are calculated.
Fix this by using size_t for the cpy_len variable.
This fixes CVE-2022-41674.
Reported-by: Soenke Huster <shuster@xxxxxxxxxxxxxxxxxxxxxx>
Tested-by: Soenke Huster <shuster@xxxxxxxxxxxxxxxxxxxxxx>
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/wireless/scan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1717,7 +1717,7 @@ cfg80211_update_notlisted_nontrans(struc
size_t new_ie_len;
struct cfg80211_bss_ies *new_ies;
const struct cfg80211_bss_ies *old;
- u8 cpy_len;
+ size_t cpy_len;
lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
Patches currently in stable-queue which might be from johannes.berg@xxxxxxxxx are
queue-5.4/wifi-cfg80211-avoid-nontransmitted-bss-list-corruption.patch
queue-5.4/wifi-cfg80211-mac80211-reject-bad-mbssid-elements.patch
queue-5.4/wifi-cfg80211-ensure-length-byte-is-present-before-access.patch
queue-5.4/wifi-mac80211_hwsim-avoid-mac80211-warning-on-bad-rate.patch
queue-5.4/wifi-cfg80211-update-hidden-bsses-to-avoid-warn_on.patch
queue-5.4/wifi-cfg80211-fix-bss-refcounting-bugs.patch
queue-5.4/wifi-cfg80211-fix-u8-overflow-in-cfg80211_update_notlisted_nontrans.patch
