Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiex_ret_802_11_scan() subtracts the fixed response fields and the firmware-provided BSS length from resp->size without first proving that either extent fits. A short response or oversized BSS length can therefore underflow tlv_buf_size and make the TLV parser walk beyond the command response. Compute the fixed extent from the selected normal or background scan response. Validate that the fixed fields and BSS data fit before deriving the TLV extent and entering the parser.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < 25217c5f6ce0bf3004f80c129464cd35fe9a420faffected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < 48312f0085aa1577d6d41af2a079b34de17c1a57affected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < dccf5ecaad4d8d43c545921f20328e8f91af8698affected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < c4943323fda22ef27bb6479b9d328ae48c63f64caffected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417affected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < 9cff2f39ed38a32070b08364c4c9346e85b8f9ecaffected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < 7106ad8b74f50cca1ef36131f327d2c78f556daaaffected5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e to < 3687d7d48070838cc2953431b3a27717cab0aaf6affected
Linux Linux
Default version status: affected
3.0affected0 to < 3.0unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/25217c5f6ce0bf3004f80c129464cd35fe9a420f ↗
- https://git.kernel.org/stable/c/48312f0085aa1577d6d41af2a079b34de17c1a57 ↗
- https://git.kernel.org/stable/c/dccf5ecaad4d8d43c545921f20328e8f91af8698 ↗
- https://git.kernel.org/stable/c/c4943323fda22ef27bb6479b9d328ae48c63f64c ↗
- https://git.kernel.org/stable/c/cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417 ↗
- https://git.kernel.org/stable/c/9cff2f39ed38a32070b08364c4c9346e85b8f9ec ↗
- https://git.kernel.org/stable/c/7106ad8b74f50cca1ef36131f327d2c78f556daa ↗
- https://git.kernel.org/stable/c/3687d7d48070838cc2953431b3a27717cab0aaf6 ↗