anierin/msm-5.15
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

UPSTREAM: wifi: mac80211: fix MBSSID parsing use-after-free

Browse Source 
commit ff05d4b45dd89b922578dac497dcabf57cf771c6 upstream.

When we parse a multi-BSSID element, we might point some
element pointers into the allocated nontransmitted_profile.
However, we free this before returning, causing UAF when the
relevant pointers in the parsed elements are accessed.

Fix this by not allocating the scratch buffer separately but
as part of the returned structure instead, that way, there
are no lifetime issues with it.

The scratch buffer introduction as part of the returned data
here is taken from MLO feature work done by Ilan.

This fixes CVE-2022-42719.

Bug: 253642087
Fixes: 5023b14cf4 ("mac80211: support profile split between elements")
Co-developed-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Cc: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I877beba33ff33b7feec91c241df3b29e0331a559
This commit is contained in:
Johannes Berg
2022-10-13 20:16:01 +02:00
committed by Lee Jones
parent ec4ab62846
commit 52808991c0
2 changed files with 22 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
net/mac80211/ieee80211_i.h
View File

@@ -1608,6 +1608,14 @@ struct ieee802_11_elems {
/* whether a parse error occurred while retrieving these elements */
bool parse_error;
/*
* scratch buffer that can be used for various element parsing related
* tasks, e.g., element de-fragmentation etc.
*/
size_t scratch_len;
u8 *scratch_pos;
u8 scratch[];
};
static inline struct ieee80211_local *hw_to_local(

29
net/mac80211/util.c
View File

@@ -1475,24 +1475,25 @@ struct ieee802_11_elems *ieee802_11_parse_elems_crc(const u8 *start, size_t len,
u8 *nontransmitted_profile;
int nontransmitted_profile_len = 0;
elems = kzalloc(sizeof(*elems), GFP_ATOMIC);
elems = kzalloc(sizeof(*elems) + len, GFP_ATOMIC);
if (!elems)
return NULL;
elems->ie_start = start;
elems->total_len = len;
nontransmitted_profile = kmalloc(len, GFP_ATOMIC);
if (nontransmitted_profile) {
nontransmitted_profile_len =
ieee802_11_find_bssid_profile(start, len, elems,
transmitter_bssid,
bss_bssid,
nontransmitted_profile);
non_inherit =
cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
nontransmitted_profile,
nontransmitted_profile_len);
}
elems->scratch_len = len;
elems->scratch_pos = elems->scratch;
nontransmitted_profile = elems->scratch_pos;
nontransmitted_profile_len =
ieee802_11_find_bssid_profile(start, len, elems,
transmitter_bssid,
bss_bssid,
nontransmitted_profile);
non_inherit =
cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
nontransmitted_profile,
nontransmitted_profile_len);
crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
crc, non_inherit);
@@ -1521,8 +1522,6 @@ struct ieee802_11_elems *ieee802_11_parse_elems_crc(const u8 *start, size_t len,
offsetofend(struct ieee80211_bssid_index, dtim_count))
elems->dtim_count = elems->bssid_index->dtim_count;
kfree(nontransmitted_profile);
elems->crc = crc;
return elems;