diff options
Diffstat (limited to 'package/mac80211/patches/415-mac80211-fix-exploit.patch')
| -rw-r--r-- | package/mac80211/patches/415-mac80211-fix-exploit.patch | 77 |
1 files changed, 77 insertions, 0 deletions
diff --git a/package/mac80211/patches/415-mac80211-fix-exploit.patch b/package/mac80211/patches/415-mac80211-fix-exploit.patch new file mode 100644 index 000000000..114c94390 --- /dev/null +++ b/package/mac80211/patches/415-mac80211-fix-exploit.patch @@ -0,0 +1,77 @@ +Subject: mac80211: fix HT information element parsing + +There's no checking that the HT IEs are of the right length +which can be used by an attacker to cause an out-of-bounds +access by sending a too short HT information/capability IE. +Fix it by simply pretending those IEs didn't exist when too +short. + +Signed-off-by: Johannes Berg <johannes@sipsolutions.net> +--- + net/mac80211/ieee80211_i.h | 6 ++---- + net/mac80211/mlme.c | 3 --- + net/mac80211/util.c | 8 ++++---- + 3 files changed, 6 insertions(+), 11 deletions(-) + +--- everything.orig/net/mac80211/ieee80211_i.h 2008-10-07 20:05:26.000000000 +0200 ++++ everything/net/mac80211/ieee80211_i.h 2008-10-07 20:06:45.000000000 +0200 +@@ -816,8 +816,8 @@ struct ieee802_11_elems { + u8 *ext_supp_rates; + u8 *wmm_info; + u8 *wmm_param; +- u8 *ht_cap_elem; +- u8 *ht_info_elem; ++ struct ieee80211_ht_cap *ht_cap_elem; ++ struct ieee80211_ht_addt_info *ht_info_elem; + u8 *mesh_config; + u8 *mesh_id; + u8 *peer_link; +@@ -844,8 +844,6 @@ struct ieee802_11_elems { + u8 ext_supp_rates_len; + u8 wmm_info_len; + u8 wmm_param_len; +- u8 ht_cap_elem_len; +- u8 ht_info_elem_len; + u8 mesh_config_len; + u8 mesh_id_len; + u8 peer_link_len; +--- everything.orig/net/mac80211/mlme.c 2008-10-07 20:06:44.000000000 +0200 ++++ everything/net/mac80211/mlme.c 2008-10-07 20:06:45.000000000 +0200 +@@ -1349,10 +1349,8 @@ static void ieee80211_rx_mgmt_assoc_resp + (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) { + struct ieee80211_ht_bss_info bss_info; + ieee80211_ht_cap_ie_to_ht_info( +- (struct ieee80211_ht_cap *) + elems.ht_cap_elem, &sta->sta.ht_info); + ieee80211_ht_addt_info_ie_to_ht_bss_info( +- (struct ieee80211_ht_addt_info *) + elems.ht_info_elem, &bss_info); + ieee80211_handle_ht(local, 1, &sta->sta.ht_info, &bss_info); + } +@@ -1715,7 +1713,6 @@ static void ieee80211_rx_mgmt_beacon(str + struct ieee80211_ht_bss_info bss_info; + + ieee80211_ht_addt_info_ie_to_ht_bss_info( +- (struct ieee80211_ht_addt_info *) + elems.ht_info_elem, &bss_info); + changed |= ieee80211_handle_ht(local, 1, &conf->ht_conf, + &bss_info); +--- everything.orig/net/mac80211/util.c 2008-10-07 20:06:43.000000000 +0200 ++++ everything/net/mac80211/util.c 2008-10-07 20:06:45.000000000 +0200 +@@ -529,12 +529,12 @@ void ieee802_11_parse_elems(u8 *start, s + elems->ext_supp_rates_len = elen; + break; + case WLAN_EID_HT_CAPABILITY: +- elems->ht_cap_elem = pos; +- elems->ht_cap_elem_len = elen; ++ if (elen >= sizeof(struct ieee80211_ht_cap)) ++ elems->ht_cap_elem = (void *)pos; + break; + case WLAN_EID_HT_EXTRA_INFO: +- elems->ht_info_elem = pos; +- elems->ht_info_elem_len = elen; ++ if (elen >= sizeof(struct ieee80211_ht_addt_info)) ++ elems->ht_info_elem = (void *)pos; + break; + case WLAN_EID_MESH_ID: + elems->mesh_id = pos; |