Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to out-of-bounds access in peer->rx_tid[]. Hence, add a decrement operation for TID, before peer cleanup to ensures proper cleanup and prevents out-of-bounds access issues when the RX peer frag setup fails. Found during code review. Compile tested only.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d889913205cf7ebda905b1e62c5867ed4e39f6c2 to < eb1e1526b82b8cf31f1ef9ca86a2647fb6cd89c6affectedd889913205cf7ebda905b1e62c5867ed4e39f6c2 to < 7c3e99fd4a66a5ac9c7dd32db07359666efe0002affectedd889913205cf7ebda905b1e62c5867ed4e39f6c2 to < a3b73c72c42348bf1555fd2b00f32f941324b242affectedd889913205cf7ebda905b1e62c5867ed4e39f6c2 to < 9530d666f4376c294cdf4348c29fe3542fec980aaffectedd889913205cf7ebda905b1e62c5867ed4e39f6c2 to < 7c0884fcd2ddde0544d2e77f297ae461e1f53f58affected
Linux Linux
Default version status: affected
6.3affected0 to < 6.3unaffected6.6.103 to ≤ 6.6.*unaffected6.12.43 to ≤ 6.12.*unaffected6.15.11 to ≤ 6.15.*unaffected6.16.2 to ≤ 6.16.*unaffected6.17 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/eb1e1526b82b8cf31f1ef9ca86a2647fb6cd89c6 ↗
- https://git.kernel.org/stable/c/7c3e99fd4a66a5ac9c7dd32db07359666efe0002 ↗
- https://git.kernel.org/stable/c/a3b73c72c42348bf1555fd2b00f32f941324b242 ↗
- https://git.kernel.org/stable/c/9530d666f4376c294cdf4348c29fe3542fec980a ↗
- https://git.kernel.org/stable/c/7c0884fcd2ddde0544d2e77f297ae461e1f53f58 ↗