Description
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since the two would otherwise collide in the BSS rbtree. The lookup for that entry also required it to match the connection's BSS type, so an entry advertising e.g. the IBSS capability bit was left in place, and the following cfg80211_rehash_bss() then ran into it: WARN_ON(!cmp) Changing the type shouldn't really happen, but can be triggered by a rogue AP/device, so drop the check and remove any entries matching the comparison.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0afd425b1b64251f19b5d8d8b49bf56fefbc643f to < 6ef87a853327434ae1cd9c5a2c27a557fb4047fcaffected0afd425b1b64251f19b5d8d8b49bf56fefbc643f to < 1380ee3a202dbb9f8e8b3c3b87eb410450d57799affected0afd425b1b64251f19b5d8d8b49bf56fefbc643f to < fb445ec7480da5d2b82bf681e3b4313603722729affected0afd425b1b64251f19b5d8d8b49bf56fefbc643f to < 65fdb973bd905bc3f5cb045a04c1828f2d2a7e24affected0afd425b1b64251f19b5d8d8b49bf56fefbc643f to < 64e23a36d8f04811372365b44cfca325f8e0f4bbaffected0afd425b1b64251f19b5d8d8b49bf56fefbc643f to < 6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25affected0afd425b1b64251f19b5d8d8b49bf56fefbc643f to < 0aa44982125c86b47961be5ac1c82eddab8080f3affected0afd425b1b64251f19b5d8d8b49bf56fefbc643f to < b377e1000d963e7182a987082b4b06580bd7ac84affected
Linux Linux
Default version status: affected
5.4affected0 to < 5.4unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6ef87a853327434ae1cd9c5a2c27a557fb4047fc ↗
- https://git.kernel.org/stable/c/1380ee3a202dbb9f8e8b3c3b87eb410450d57799 ↗
- https://git.kernel.org/stable/c/fb445ec7480da5d2b82bf681e3b4313603722729 ↗
- https://git.kernel.org/stable/c/65fdb973bd905bc3f5cb045a04c1828f2d2a7e24 ↗
- https://git.kernel.org/stable/c/64e23a36d8f04811372365b44cfca325f8e0f4bb ↗
- https://git.kernel.org/stable/c/6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25 ↗
- https://git.kernel.org/stable/c/0aa44982125c86b47961be5ac1c82eddab8080f3 ↗
- https://git.kernel.org/stable/c/b377e1000d963e7182a987082b4b06580bd7ac84 ↗