This is a note to let you know that I've just added the patch titled
wifi: mac80211: fix MBSSID parsing use-after-free
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
wifi-mac80211-fix-mbssid-parsing-use-after-free.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Sat Oct 15 05:26:34 PM CEST 2022
From: Johannes Berg <johannes@xxxxxxxxxxxxxxxx>
Date: Fri, 14 Oct 2022 18:41:50 +0200
Subject: wifi: mac80211: fix MBSSID parsing use-after-free
To: linux-wireless@xxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx
Cc: Felix Fietkau <nbd@xxxxxxxx>, Thadeu Lima de Souza Cascardo <cascardo@xxxxxxxxxxxxx>, Marcus Meissner <meissner@xxxxxxx>, Jiri Kosina <jkosina@xxxxxxx>, Johannes Berg <johannes.berg@xxxxxxxxx>, Ilan Peer <ilan.peer@xxxxxxxxx>, Kees Cook <keescook@xxxxxxxxxxxx>
Message-ID: <20221014184133.bbea30b40ae3.I4691a91b83e1325524f786a638e853ccb49c2443@changeid>
From: Johannes Berg <johannes.berg@xxxxxxxxx>
Commit ff05d4b45dd89b922578dac497dcabf57cf771c6 upstream.
This is a different version of the commit, changed to store
the non-transmitted profile in the elems, and freeing it in
the few places where it's relevant, since that is only the
case when the last argument for parsing (the non-tx BSSID)
is non-NULL.
When we parse a multi-BSSID element, we might point some
element pointers into the allocated nontransmitted_profile.
However, we free this before returning, causing UAF when the
relevant pointers in the parsed elements are accessed.
Fix this by not allocating the scratch buffer separately but
as part of the returned structure instead, that way, there
are no lifetime issues with it.
The scratch buffer introduction as part of the returned data
here is taken from MLO feature work done by Ilan.
This fixes CVE-2022-42719.
Fixes: 5023b14cf4df ("mac80211: support profile split between elements")
Co-developed-by: Ilan Peer <ilan.peer@xxxxxxxxx>
Signed-off-by: Ilan Peer <ilan.peer@xxxxxxxxx>
Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/mac80211/ieee80211_i.h | 2 ++
net/mac80211/mlme.c | 6 +++++-
net/mac80211/scan.c | 2 ++
net/mac80211/util.c | 7 ++++++-
4 files changed, 15 insertions(+), 2 deletions(-)
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1551,6 +1551,8 @@ struct ieee802_11_elems {
u8 country_elem_len;
u8 bssid_index_len;
+ void *nontx_profile;
+
/* whether a parse error occurred while retrieving these elements */
bool parse_error;
};
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3394,6 +3394,7 @@ static bool ieee80211_assoc_success(stru
sdata_info(sdata,
"AP bug: VHT operation missing from AssocResp\n");
}
+ kfree(bss_elems.nontx_profile);
}
/*
@@ -4045,6 +4046,7 @@ static void ieee80211_rx_mgmt_beacon(str
ifmgd->assoc_data->timeout = jiffies;
ifmgd->assoc_data->timeout_started = true;
run_again(sdata, ifmgd->assoc_data->timeout);
+ kfree(elems.nontx_profile);
return;
}
@@ -4222,7 +4224,7 @@ static void ieee80211_rx_mgmt_beacon(str
ieee80211_report_disconnect(sdata, deauth_buf,
sizeof(deauth_buf), true,
WLAN_REASON_DEAUTH_LEAVING);
- return;
+ goto free;
}
if (sta && elems.opmode_notif)
@@ -4237,6 +4239,8 @@ static void ieee80211_rx_mgmt_beacon(str
elems.cisco_dtpc_elem);
ieee80211_bss_info_change_notify(sdata, changed);
+free:
+ kfree(elems.nontx_profile);
}
void ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data *sdata,
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -227,6 +227,8 @@ ieee80211_bss_info_update(struct ieee802
rx_status, beacon);
}
+ kfree(elems.nontx_profile);
+
return bss;
}
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1483,6 +1483,11 @@ u32 ieee802_11_parse_elems_crc(const u8
cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
nontransmitted_profile,
nontransmitted_profile_len);
+ if (!nontransmitted_profile_len) {
+ nontransmitted_profile_len = 0;
+ kfree(nontransmitted_profile);
+ nontransmitted_profile = NULL;
+ }
}
crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
@@ -1512,7 +1517,7 @@ u32 ieee802_11_parse_elems_crc(const u8
offsetofend(struct ieee80211_bssid_index, dtim_count))
elems->dtim_count = elems->bssid_index->dtim_count;
- kfree(nontransmitted_profile);
+ elems->nontx_profile = nontransmitted_profile;
return crc;
}
Patches currently in stable-queue which might be from johannes@xxxxxxxxxxxxxxxx are
queue-5.10/wifi-mac80211-don-t-parse-mbssid-in-assoc-response.patch
queue-5.10/mac80211-mlme-find-auth-challenge-directly.patch
queue-5.10/wifi-mac80211-fix-mbssid-parsing-use-after-free.patch
