Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header. ieee80211_mesh_hwmp_preq_get_bottom() reads the flags byte to account for the optional Address Extension field. Consequently, an empty PREQ element causes a one-byte read beyond its declared payload. Move the helper call after both size checks, so the bottom fields are only accessed when they are present.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae to < 3beddbd56946577478fd5e649f556aaaebe15b0aaffected8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae to < e6031f02269c0f51cf67886d177f02bc300b47cdaffected
Linux Linux
Default version status: affected
7.2affected0 to < 7.2unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected