Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen with syzkaller: UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') This was missed in the initial conversions because I failed to locate the allocation likely due to the "sizeof(void *)" not matching the "channels" array type.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e3eac9f32ec04112b39e01b574ac739382469bf9 to < fde33ab3c052a302ee8a0b739094b88ceae4dd67affectede3eac9f32ec04112b39e01b574ac739382469bf9 to < 07c737d9ab02c07b562aefcca16aa95077368e24affectede3eac9f32ec04112b39e01b574ac739382469bf9 to < e3192e999a0d05ea0ba2c59c09afaf0b8ee70b81affectede3eac9f32ec04112b39e01b574ac739382469bf9 to < 82bbe02b2500ef0a62053fe2eb84773fe31c5a0aaffected
Linux Linux
Default version status: affected
6.6affected0 to < 6.6unaffected6.6.92 to ≤ 6.6.*unaffected6.12.30 to ≤ 6.12.*unaffected6.14.8 to ≤ 6.14.*unaffected6.15 to ≤ *unaffected