Description
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem) but never advances mbssid_elem or sub_elem inside the body. Each iteration therefore searches for a continuation that follows the same fixed pair; the helper returns the same next_mbssid; and the same next_sub bytes are memcpy()'d into merged_ie at a growing offset until the buffer fills. Advance both mbssid_elem and sub_elem to the just-consumed continuation so the next call to cfg80211_get_profile_continuation() searches for a further continuation beyond it (or returns NULL when none exists). A specially-crafted malicious beacon can take advantage of this bug to cause the kernel to spend an excessive amount of time in cfg80211_merge_profile (up to as much as 2ms per beacon received), which could theoretically be abused in some way.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
fe806e4992c9047affd263bcc13b2c047029a726 to < 5817e1e5205498a5df66eba2b34e817f4210fd0faffectedfe806e4992c9047affd263bcc13b2c047029a726 to < cedbb608494ba1e7a5c6c56b7f1d3fd470094f28affectedfe806e4992c9047affd263bcc13b2c047029a726 to < c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8affectedfe806e4992c9047affd263bcc13b2c047029a726 to < 1ced0f5a851f9cae274545a42a06c459b7fd8881affectedfe806e4992c9047affd263bcc13b2c047029a726 to < 67915715fd3874057457363c87c63e18829527dfaffectedfe806e4992c9047affd263bcc13b2c047029a726 to < 6cfae4914439878b8acb35c7e3b40096eeb2ad9caffectedfe806e4992c9047affd263bcc13b2c047029a726 to < 1343a480f84b80c1249133a90ef87f8751d65cbbaffectedfe806e4992c9047affd263bcc13b2c047029a726 to < 7666dbb1bacc4ba522b96740cba7283d243d16e1affected
Linux Linux
Default version status: affected
5.2affected0 to < 5.2unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.142 to ≤ 6.6.*unaffected6.12.92 to ≤ 6.12.*unaffected6.18.34 to ≤ 6.18.*unaffected7.0.11 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/5817e1e5205498a5df66eba2b34e817f4210fd0f ↗
- https://git.kernel.org/stable/c/cedbb608494ba1e7a5c6c56b7f1d3fd470094f28 ↗
- https://git.kernel.org/stable/c/c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8 ↗
- https://git.kernel.org/stable/c/1ced0f5a851f9cae274545a42a06c459b7fd8881 ↗
- https://git.kernel.org/stable/c/67915715fd3874057457363c87c63e18829527df ↗
- https://git.kernel.org/stable/c/6cfae4914439878b8acb35c7e3b40096eeb2ad9c ↗
- https://git.kernel.org/stable/c/1343a480f84b80c1249133a90ef87f8751d65cbb ↗
- https://git.kernel.org/stable/c/7666dbb1bacc4ba522b96740cba7283d243d16e1 ↗