linux-cve-announce - CVE-2024-26779: wifi: mac80211: fix race condition on enabling fast-xmit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024040310-CVE-2024-26779-8030@gregkh>
Date: Wed,  3 Apr 2024 19:31:46 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-26779: wifi: mac80211: fix race condition on enabling fast-xmit

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix race condition on enabling fast-xmit

fast-xmit must only be enabled after the sta has been uploaded to the driver,
otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls
to the driver, leading to potential crashes because of uninitialized drv_priv
data.
Add a missing sta->uploaded check and re-check fast xmit after inserting a sta.

The Linux kernel CVE team has assigned CVE-2024-26779 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.308 with commit 76fad1174a0c
	Fixed in 5.4.270 with commit 85720b69aef1
	Fixed in 5.10.211 with commit 5ffab99e070b
	Fixed in 5.15.150 with commit 88c18fd06608
	Fixed in 6.1.80 with commit eb39bb548bf9
	Fixed in 6.6.19 with commit 54b79d878696
	Fixed in 6.7.7 with commit 281280276b70
	Fixed in 6.8 with commit bcbc84af1183

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26779
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/mac80211/sta_info.c
	net/mac80211/tx.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/76fad1174a0cae6fc857b9f88b261a2e4f07d587
	https://git.kernel.org/stable/c/85720b69aef177318f4a18efbcc4302228a340e5
	https://git.kernel.org/stable/c/5ffab99e070b9f8ae0cf60c3c3602b84eee818dd
	https://git.kernel.org/stable/c/88c18fd06608b3adee547102505d715f21075c9d
	https://git.kernel.org/stable/c/eb39bb548bf974acad7bd6780fe11f9e6652d696
	https://git.kernel.org/stable/c/54b79d8786964e2f840e8a2ec4a9f9a50f3d4954
	https://git.kernel.org/stable/c/281280276b70c822f55ce15b661f6d1d3228aaa9
	https://git.kernel.org/stable/c/bcbc84af1183c8cf3d1ca9b78540c2185cd85e7f