Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLA_BINARY .len is a maximum) and the op sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is accepted and the loop reads past the payload. Require the exact length in the policy, so a malformed attribute is rejected before the handler runs.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5d44fe7c9808c56e136e59147bd932f5491520f1 to < 3a96bb65b4b820d8b41fa155781ec1c29e3479d4affected5d44fe7c9808c56e136e59147bd932f5491520f1 to < 59e1f2a0242232b4a3af144ae317d3913fc09046affected5d44fe7c9808c56e136e59147bd932f5491520f1 to < 1ae85bb34fe3510659b86d6a5f8036dd498233f8affected5d44fe7c9808c56e136e59147bd932f5491520f1 to < 6f6368b20f8c9481fa7ba7b672dcb3c9f36b2695affected5d44fe7c9808c56e136e59147bd932f5491520f1 to < b5b1234bbfa25537fb9a5c0d62c328ed4547f721affected5d44fe7c9808c56e136e59147bd932f5491520f1 to < 13edd8ea7ff2ce6a964b290ef2034cd8cbed96c7affected5d44fe7c9808c56e136e59147bd932f5491520f1 to < 3dc723ac78a6e4fa0fd49e27e487ed319da40a9faffected
Linux Linux
Default version status: affected
5.7affected0 to < 5.7unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3a96bb65b4b820d8b41fa155781ec1c29e3479d4 ↗
- https://git.kernel.org/stable/c/59e1f2a0242232b4a3af144ae317d3913fc09046 ↗
- https://git.kernel.org/stable/c/1ae85bb34fe3510659b86d6a5f8036dd498233f8 ↗
- https://git.kernel.org/stable/c/6f6368b20f8c9481fa7ba7b672dcb3c9f36b2695 ↗
- https://git.kernel.org/stable/c/b5b1234bbfa25537fb9a5c0d62c328ed4547f721 ↗
- https://git.kernel.org/stable/c/13edd8ea7ff2ce6a964b290ef2034cd8cbed96c7 ↗
- https://git.kernel.org/stable/c/3dc723ac78a6e4fa0fd49e27e487ed319da40a9f ↗