Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() Replace one-element array with a flexible-array member in `struct mwifiex_ie_types_wildcard_ssid_params` to fix the following warning on a MT8173 Chromebook (mt8173-elm-hana): [ 356.775250] ------------[ cut here ]------------ [ 356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1) [ 356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex] The "(size 6)" above is exactly the length of the SSID of the network this device was connected to. The source of the warning looks like: ssid_len = user_scan_in->ssid_list[i].ssid_len; [...] memcpy(wildcard_ssid_tlv->ssid, user_scan_in->ssid_list[i].ssid, ssid_len); There is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this struct, but it already didn't account for the size of the one-element array, so it doesn't need to be changed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < a09760c513ae0f98c7082a1deace7fb6284ee866affected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < 1de0ca1d7320a645ba2ee5954f64be08935b002aaffected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < 5fa329c44e1e635da2541eab28b6cdb8464fc8d1affected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < 581261b2d6fdb4237b24fa13f5a5f87bf2861f2caffected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < b466746cfb6be43f9a1457bbee52ade397fb23eaaffected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < c4698ef8c42e02782604bf4f8a489dbf6b0c1365affected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < e2de22e4b6213371d9e76f74a10ce817572a8d74affected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < d7774910c5583e61c5fe2571280366624ef48036affected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < d241a139c2e9f8a479f25c75ebd5391e6a448500affected
Linux Linux
Default version status: affected
3.0affected0 to < 3.0unaffected4.19.325 to ≤ 4.19.*unaffected5.4.287 to ≤ 5.4.*unaffected5.10.231 to ≤ 5.10.*unaffected5.15.174 to ≤ 5.15.*unaffected6.1.120 to ≤ 6.1.*unaffected6.6.64 to ≤ 6.6.*unaffected6.11.11 to ≤ 6.11.*unaffected6.12.2 to ≤ 6.12.*unaffected6.13 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a09760c513ae0f98c7082a1deace7fb6284ee866 ↗
- https://git.kernel.org/stable/c/1de0ca1d7320a645ba2ee5954f64be08935b002a ↗
- https://git.kernel.org/stable/c/5fa329c44e1e635da2541eab28b6cdb8464fc8d1 ↗
- https://git.kernel.org/stable/c/581261b2d6fdb4237b24fa13f5a5f87bf2861f2c ↗
- https://git.kernel.org/stable/c/b466746cfb6be43f9a1457bbee52ade397fb23ea ↗
- https://git.kernel.org/stable/c/c4698ef8c42e02782604bf4f8a489dbf6b0c1365 ↗
- https://git.kernel.org/stable/c/e2de22e4b6213371d9e76f74a10ce817572a8d74 ↗
- https://git.kernel.org/stable/c/d7774910c5583e61c5fe2571280366624ef48036 ↗
- https://git.kernel.org/stable/c/d241a139c2e9f8a479f25c75ebd5391e6a448500 ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html ↗