This is a note to let you know that I've just added the patch titled
wifi: wilc1000: validate pairwise and authentication suite offsets
to the 6.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
wifi-wilc1000-validate-pairwise-and-authentication-suite-offsets.patch
and it can be found in the queue-6.0 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From cd21d99e595ec1d8721e1058dcdd4f1f7de1d793 Mon Sep 17 00:00:00 2001
From: Phil Turnbull <philipturnbull@xxxxxxxxxx>
Date: Wed, 23 Nov 2022 10:35:40 -0500
Subject: wifi: wilc1000: validate pairwise and authentication suite offsets
From: Phil Turnbull <philipturnbull@xxxxxxxxxx>
commit cd21d99e595ec1d8721e1058dcdd4f1f7de1d793 upstream.
There is no validation of 'offset' which can trigger an out-of-bounds
read when extracting RSN capabilities.
Signed-off-by: Phil Turnbull <philipturnbull@xxxxxxxxxx>
Tested-by: Ajay Kathat <ajay.kathat@xxxxxxxxxxxxx>
Acked-by: Ajay Kathat <ajay.kathat@xxxxxxxxxxxxx>
Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20221123153543.8568-2-philipturnbull@xxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/net/wireless/microchip/wilc1000/hif.c | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
--- a/drivers/net/wireless/microchip/wilc1000/hif.c
+++ b/drivers/net/wireless/microchip/wilc1000/hif.c
@@ -482,14 +482,25 @@ void *wilc_parse_join_bss_param(struct c
rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len);
if (rsn_ie) {
+ int rsn_ie_len = sizeof(struct element) + rsn_ie[1];
int offset = 8;
- param->mode_802_11i = 2;
- param->rsn_found = true;
/* extract RSN capabilities */
- offset += (rsn_ie[offset] * 4) + 2;
- offset += (rsn_ie[offset] * 4) + 2;
- memcpy(param->rsn_cap, &rsn_ie[offset], 2);
+ if (offset < rsn_ie_len) {
+ /* skip over pairwise suites */
+ offset += (rsn_ie[offset] * 4) + 2;
+
+ if (offset < rsn_ie_len) {
+ /* skip over authentication suites */
+ offset += (rsn_ie[offset] * 4) + 2;
+
+ if (offset + 1 < rsn_ie_len) {
+ param->mode_802_11i = 2;
+ param->rsn_found = true;
+ memcpy(param->rsn_cap, &rsn_ie[offset], 2);
+ }
+ }
+ }
}
if (param->rsn_found) {
Patches currently in stable-queue which might be from philipturnbull@xxxxxxxxxx are
queue-6.0/wifi-wilc1000-validate-number-of-channels.patch
queue-6.0/wifi-wilc1000-validate-length-of-ieee80211_p2p_attr_channel_list-attribute.patch
queue-6.0/wifi-wilc1000-validate-length-of-ieee80211_p2p_attr_oper_channel-attribute.patch
queue-6.0/wifi-wilc1000-validate-pairwise-and-authentication-suite-offsets.patch
