Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate TX_CMD response layout TX_CMD parsing uses frame_count to walk status entries and then read the trailing SCD SSN. Make the minimum-length check follow that exact runtime layout calculation before parsing the payload. For new TX API, reject TX_CMD responses with frame_count != 1 and warn/return in the aggregation handler to document that aggregated accounting is expected via BA notifications.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c to < 658b5c00d653cdd72babc86791f6f6711190c740affected8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c to < 5e871c03506c529d5fe372d099c1ad1465c7bc38affected8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c to < fc14f5fe8a4374ed1088cfbddc1dae4d16c9935baffected8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c to < 4d942dfc13aec393e003ab28ff58db744c26e6ebaffected8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c to < 8d70881707b47353359df57df12f6de67fdacdd2affected
Linux Linux
Default version status: affected
3.9affected0 to < 3.9unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/658b5c00d653cdd72babc86791f6f6711190c740 ↗
- https://git.kernel.org/stable/c/5e871c03506c529d5fe372d099c1ad1465c7bc38 ↗
- https://git.kernel.org/stable/c/fc14f5fe8a4374ed1088cfbddc1dae4d16c9935b ↗
- https://git.kernel.org/stable/c/4d942dfc13aec393e003ab28ff58db744c26e6eb ↗
- https://git.kernel.org/stable/c/8d70881707b47353359df57df12f6de67fdacdd2 ↗