Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: change DMA direction while mapping reinjected packets For fragmented packets, ath12k reassembles each fragment as a normal packet and then reinjects it into HW ring. In this case, the DMA direction should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise, an invalid payload may be reinjected into the HW and subsequently delivered to the host. Given that arbitrary memory can be allocated to the skb buffer, knowledge about the data contained in the reinjected buffer is lacking. Consequently, there’s a risk of private information being leaked. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d889913205cf7ebda905b1e62c5867ed4e39f6c2 to < e99d9b16ff153de9540073239d24adc3b0a3a997affectedd889913205cf7ebda905b1e62c5867ed4e39f6c2 to < 6925320fcd40d8042d32bf4ede8248e7a5315c3baffectedd889913205cf7ebda905b1e62c5867ed4e39f6c2 to < 33322e3ef07409278a18c6919c448e369d66a18eaffected
Linux Linux
Default version status: affected
6.3affected0 to < 6.3unaffected6.6.44 to ≤ 6.6.*unaffected6.10.3 to ≤ 6.10.*unaffected6.11 to ≤ *unaffected