Commit e12ee596 authored by Johannes Berg's avatar Johannes Berg Committed by Jialin Zhang
Browse files

wifi: cfg80211/mac80211: reject bad MBSSID elements 

stable inclusion
from stable-v5.10.148
commit e7aa7fd10eba32835de3dfa7f1691a90043faa73
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I6D0WL

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e7aa7fd10eba32835de3dfa7f1691a90043faa73



--------------------------------

commit 8f033d2b upstream.

Per spec, the maximum value for the MaxBSSID ('n') indicator is 8,
and the minimum is 1 since a multiple BSSID set with just one BSSID
doesn't make sense (the # of BSSIDs is limited by 2^n).

Limit this in the parsing in both cfg80211 and mac80211, rejecting
any elements with an invalid value.

This fixes potentially bad shifts in the processing of these inside
the cfg80211_gen_new_bssid() function later.

I found this during the investigation of CVE-2022-41674 fixed by the
previous patch.

Fixes: 0b8fb823 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Fixes: 78ac51f8 ("mac80211: support multi-bssid")
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Reviewed-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent 5ae177ab

net/mac80211/util.c

+2 −0
Original line number Diff line number Diff line
@@ -1409,6 +1409,8 @@ static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len, 
	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) {

		if (elem->datalen < 2)

			continue;

		if (elem->data[0] < 1 || elem->data[0] > 8)

			continue;



		for_each_element(sub, elem->data + 1, elem->datalen - 1) {

			u8 new_bssid[ETH_ALEN];

net/wireless/scan.c

+2 −0
Original line number Diff line number Diff line
@@ -2103,6 +2103,8 @@ static void cfg80211_parse_mbssid_data(struct wiphy *wiphy, 
	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) {

		if (elem->datalen < 4)

			continue;

		if (elem->data[0] < 1 || (int)elem->data[0] > 8)

			continue;

		for_each_element(sub, elem->data + 1, elem->datalen - 1) {

			u8 profile_len;