diff options
Diffstat (limited to 'Buffer-overflow-read-checks-in-mwifiex.patch')
| -rw-r--r-- | Buffer-overflow-read-checks-in-mwifiex.patch | 238 |
1 files changed, 238 insertions, 0 deletions
diff --git a/Buffer-overflow-read-checks-in-mwifiex.patch b/Buffer-overflow-read-checks-in-mwifiex.patch new file mode 100644 index 000000000..00ae1fa9c --- /dev/null +++ b/Buffer-overflow-read-checks-in-mwifiex.patch @@ -0,0 +1,238 @@ +From patchwork Wed May 29 12:52:19 2019 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +X-Patchwork-Submitter: Takashi Iwai <tiwai@suse.de> +X-Patchwork-Id: 10967049 +X-Patchwork-Delegate: kvalo@adurom.com +Return-Path: <linux-wireless-owner@kernel.org> +Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org + [172.30.200.125]) + by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3C6B01575 + for <patchwork-linux-wireless@patchwork.kernel.org>; + Wed, 29 May 2019 12:52:41 +0000 (UTC) +Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) + by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2FD42287D4 + for <patchwork-linux-wireless@patchwork.kernel.org>; + Wed, 29 May 2019 12:52:41 +0000 (UTC) +Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) + id 2E25D2897A; Wed, 29 May 2019 12:52:41 +0000 (UTC) +X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on + pdx-wl-mail.web.codeaurora.org +X-Spam-Level: +X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, + RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 +Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) + by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A60B52895F + for <patchwork-linux-wireless@patchwork.kernel.org>; + Wed, 29 May 2019 12:52:40 +0000 (UTC) +Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand + id S1727034AbfE2Mwk (ORCPT + <rfc822;patchwork-linux-wireless@patchwork.kernel.org>); + Wed, 29 May 2019 08:52:40 -0400 +Received: from mx2.suse.de ([195.135.220.15]:33780 "EHLO mx1.suse.de" + rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP + id S1725936AbfE2Mwj (ORCPT <rfc822;linux-wireless@vger.kernel.org>); + Wed, 29 May 2019 08:52:39 -0400 +X-Virus-Scanned: by amavisd-new at test-mx.suse.de +Received: from relay2.suse.de (unknown [195.135.220.254]) + by mx1.suse.de (Postfix) with ESMTP id EA4CCB00B; + Wed, 29 May 2019 12:52:37 +0000 (UTC) +From: Takashi Iwai <tiwai@suse.de> +To: linux-wireless@vger.kernel.org +Cc: Amitkumar Karwar <amitkarwar@gmail.com>, + Nishant Sarmukadam <nishants@marvell.com>, + Ganapathi Bhat <gbhat@marvell.com>, + Xinming Hu <huxinming820@gmail.com>, + Kalle Valo <kvalo@codeaurora.org>, huangwen@venustech.com.cn, + Solar Designer <solar@openwall.com>, + Marcus Meissner <meissner@suse.de> +Subject: [PATCH 1/2] mwifiex: Fix possible buffer overflows at parsing bss + descriptor +Date: Wed, 29 May 2019 14:52:19 +0200 +Message-Id: <20190529125220.17066-2-tiwai@suse.de> +X-Mailer: git-send-email 2.16.4 +In-Reply-To: <20190529125220.17066-1-tiwai@suse.de> +References: <20190529125220.17066-1-tiwai@suse.de> +Sender: linux-wireless-owner@vger.kernel.org +Precedence: bulk +List-ID: <linux-wireless.vger.kernel.org> +X-Mailing-List: linux-wireless@vger.kernel.org +X-Virus-Scanned: ClamAV using ClamSMTP + +mwifiex_update_bss_desc_with_ie() calls memcpy() unconditionally in +a couple places without checking the destination size. Since the +source is given from user-space, this may trigger a heap buffer +overflow. + +Fix it by putting the length check before performing memcpy(). + +This fix addresses CVE-2019-3846. + +Reported-by: huangwen <huangwen@venustech.com.cn> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +--- + drivers/net/wireless/marvell/mwifiex/scan.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c +index 935778ec9a1b..64ab6fe78c0d 100644 +--- a/drivers/net/wireless/marvell/mwifiex/scan.c ++++ b/drivers/net/wireless/marvell/mwifiex/scan.c +@@ -1247,6 +1247,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, + } + switch (element_id) { + case WLAN_EID_SSID: ++ if (element_len > IEEE80211_MAX_SSID_LEN) ++ return -EINVAL; + bss_entry->ssid.ssid_len = element_len; + memcpy(bss_entry->ssid.ssid, (current_ptr + 2), + element_len); +@@ -1256,6 +1258,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, + break; + + case WLAN_EID_SUPP_RATES: ++ if (element_len > MWIFIEX_SUPPORTED_RATES) ++ return -EINVAL; + memcpy(bss_entry->data_rates, current_ptr + 2, + element_len); + memcpy(bss_entry->supported_rates, current_ptr + 2, + +From patchwork Wed May 29 12:52:20 2019 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +X-Patchwork-Submitter: Takashi Iwai <tiwai@suse.de> +X-Patchwork-Id: 10967047 +X-Patchwork-Delegate: kvalo@adurom.com +Return-Path: <linux-wireless-owner@kernel.org> +Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org + [172.30.200.125]) + by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 05B0D92A + for <patchwork-linux-wireless@patchwork.kernel.org>; + Wed, 29 May 2019 12:52:41 +0000 (UTC) +Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) + by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EB3CC28972 + for <patchwork-linux-wireless@patchwork.kernel.org>; + Wed, 29 May 2019 12:52:40 +0000 (UTC) +Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) + id DF23B28978; Wed, 29 May 2019 12:52:40 +0000 (UTC) +X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on + pdx-wl-mail.web.codeaurora.org +X-Spam-Level: +X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, + RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 +Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) + by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8221B20121 + for <patchwork-linux-wireless@patchwork.kernel.org>; + Wed, 29 May 2019 12:52:40 +0000 (UTC) +Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand + id S1727023AbfE2Mwj (ORCPT + <rfc822;patchwork-linux-wireless@patchwork.kernel.org>); + Wed, 29 May 2019 08:52:39 -0400 +Received: from mx2.suse.de ([195.135.220.15]:33796 "EHLO mx1.suse.de" + rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP + id S1727017AbfE2Mwj (ORCPT <rfc822;linux-wireless@vger.kernel.org>); + Wed, 29 May 2019 08:52:39 -0400 +X-Virus-Scanned: by amavisd-new at test-mx.suse.de +Received: from relay2.suse.de (unknown [195.135.220.254]) + by mx1.suse.de (Postfix) with ESMTP id 06E82B010; + Wed, 29 May 2019 12:52:38 +0000 (UTC) +From: Takashi Iwai <tiwai@suse.de> +To: linux-wireless@vger.kernel.org +Cc: Amitkumar Karwar <amitkarwar@gmail.com>, + Nishant Sarmukadam <nishants@marvell.com>, + Ganapathi Bhat <gbhat@marvell.com>, + Xinming Hu <huxinming820@gmail.com>, + Kalle Valo <kvalo@codeaurora.org>, huangwen@venustech.com.cn, + Solar Designer <solar@openwall.com>, + Marcus Meissner <meissner@suse.de> +Subject: [PATCH 2/2] mwifiex: Abort at too short BSS descriptor element +Date: Wed, 29 May 2019 14:52:20 +0200 +Message-Id: <20190529125220.17066-3-tiwai@suse.de> +X-Mailer: git-send-email 2.16.4 +In-Reply-To: <20190529125220.17066-1-tiwai@suse.de> +References: <20190529125220.17066-1-tiwai@suse.de> +Sender: linux-wireless-owner@vger.kernel.org +Precedence: bulk +List-ID: <linux-wireless.vger.kernel.org> +X-Mailing-List: linux-wireless@vger.kernel.org +X-Virus-Scanned: ClamAV using ClamSMTP + +Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that +the source descriptor entries contain the enough size for each type +and performs copying without checking the source size. This may lead +to read over boundary. + +Fix this by putting the source size check in appropriate places. + +Signed-off-by: Takashi Iwai <tiwai@suse.de> +--- + drivers/net/wireless/marvell/mwifiex/scan.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c +index 64ab6fe78c0d..c269a0de9413 100644 +--- a/drivers/net/wireless/marvell/mwifiex/scan.c ++++ b/drivers/net/wireless/marvell/mwifiex/scan.c +@@ -1269,6 +1269,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, + break; + + case WLAN_EID_FH_PARAMS: ++ if (element_len + 2 < sizeof(*fh_param_set)) ++ return -EINVAL; + fh_param_set = + (struct ieee_types_fh_param_set *) current_ptr; + memcpy(&bss_entry->phy_param_set.fh_param_set, +@@ -1277,6 +1279,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, + break; + + case WLAN_EID_DS_PARAMS: ++ if (element_len + 2 < sizeof(*ds_param_set)) ++ return -EINVAL; + ds_param_set = + (struct ieee_types_ds_param_set *) current_ptr; + +@@ -1288,6 +1292,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, + break; + + case WLAN_EID_CF_PARAMS: ++ if (element_len + 2 < sizeof(*cf_param_set)) ++ return -EINVAL; + cf_param_set = + (struct ieee_types_cf_param_set *) current_ptr; + memcpy(&bss_entry->ss_param_set.cf_param_set, +@@ -1296,6 +1302,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, + break; + + case WLAN_EID_IBSS_PARAMS: ++ if (element_len + 2 < sizeof(*ibss_param_set)) ++ return -EINVAL; + ibss_param_set = + (struct ieee_types_ibss_param_set *) + current_ptr; +@@ -1305,10 +1313,14 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, + break; + + case WLAN_EID_ERP_INFO: ++ if (!element_len) ++ return -EINVAL; + bss_entry->erp_flags = *(current_ptr + 2); + break; + + case WLAN_EID_PWR_CONSTRAINT: ++ if (!element_len) ++ return -EINVAL; + bss_entry->local_constraint = *(current_ptr + 2); + bss_entry->sensed_11h = true; + break; +@@ -1349,6 +1361,9 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, + break; + + case WLAN_EID_VENDOR_SPECIFIC: ++ if (element_len + 2 < sizeof(vendor_ie->vend_hdr)) ++ return -EINVAL; ++ + vendor_ie = (struct ieee_types_vendor_specific *) + current_ptr; + |