Description
In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterator->_next_ns_data isn't initialized (it's only set for skipping vendor namespaces), and syzbot points out that we later compare against this uninitialized value. Fix this by moving the rejection of unknown radiotap fields down to after the in-namespace lookup, so it will really use iterator->_next_ns_data only for vendor namespaces, even in case undefined fields are present.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
33e5a2f776e331dc8a4379b6efb660d38f182d96 to < 6f80f6a60f5d87e5de5fb2732751fce799991c24affected33e5a2f776e331dc8a4379b6efb660d38f182d96 to < d1d1d3c50095928624a95b67a6d7ccc3a18f2215affected33e5a2f776e331dc8a4379b6efb660d38f182d96 to < 703fa979badbba83d31cd011606d060bfb8b0d1daffected33e5a2f776e331dc8a4379b6efb660d38f182d96 to < 129c8bb320a7cef692c78056ef8e89a2a12ba448affected33e5a2f776e331dc8a4379b6efb660d38f182d96 to < 2a60c588d5d39ad187628f58395c776a97fd4323affected33e5a2f776e331dc8a4379b6efb660d38f182d96 to < 2f8ceeba670610d66f77def32011f48de951d781affected33e5a2f776e331dc8a4379b6efb660d38f182d96 to < e664971759a0e5570b50c6592e58a7f97d55e992affected33e5a2f776e331dc8a4379b6efb660d38f182d96 to < c854758abe0b8d86f9c43dc060ff56a0ee5b31e0affected
Linux Linux
Default version status: affected
2.6.34affected0 to < 2.6.34unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.77 to ≤ 6.12.*unaffected6.18.17 to ≤ 6.18.*unaffected6.19.7 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6f80f6a60f5d87e5de5fb2732751fce799991c24 ↗
- https://git.kernel.org/stable/c/d1d1d3c50095928624a95b67a6d7ccc3a18f2215 ↗
- https://git.kernel.org/stable/c/703fa979badbba83d31cd011606d060bfb8b0d1d ↗
- https://git.kernel.org/stable/c/129c8bb320a7cef692c78056ef8e89a2a12ba448 ↗
- https://git.kernel.org/stable/c/2a60c588d5d39ad187628f58395c776a97fd4323 ↗
- https://git.kernel.org/stable/c/2f8ceeba670610d66f77def32011f48de951d781 ↗
- https://git.kernel.org/stable/c/e664971759a0e5570b50c6592e58a7f97d55e992 ↗
- https://git.kernel.org/stable/c/c854758abe0b8d86f9c43dc060ff56a0ee5b31e0 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗