Message-ID: <2025040130-CVE-2025-21910-1f2f@gregkh>
Date: Tue,  1 Apr 2025 16:39:34 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-21910: wifi: cfg80211: regulatory: improve invalid hints checking

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: regulatory: improve invalid hints checking

Syzbot keeps reporting an issue [1] that occurs when erroneous symbols
sent from userspace get through into user_alpha2[] via
regulatory_hint_user() call. Such invalid regulatory hints should be
rejected.

While a sanity check from commit 47caf685a685 ("cfg80211: regulatory:
reject invalid hints") looks to be enough to deter these very cases,
there is a way to get around it due to 2 reasons.

1) The way isalpha() works, symbols other than latin lower and
upper letters may be used to determine a country/domain.
For instance, greek letters will also be considered upper/lower
letters and for such characters isalpha() will return true as well.
However, ISO-3166-1 alpha2 codes should only hold latin
characters.

2) While processing a user regulatory request, between
reg_process_hint_user() and regulatory_hint_user() there happens to
be a call to queue_regulatory_request() which modifies letters in
request->alpha2[] with toupper(). This works fine for latin symbols,
less so for weird letter characters from the second part of _ctype[].

Syzbot triggers a warning in is_user_regdom_saved() by first sending
over an unexpected non-latin letter that gets malformed by toupper()
into a character that ends up failing isalpha() check.

Prevent this by enhancing is_an_alpha2() to ensure that incoming
symbols are latin letters and nothing else.

[1] Syzbot report:
------------[ cut here ]------------
Unexpected user alpha2: A�
WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 is_user_regdom_saved net/wireless/reg.c:440 [inline]
WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_alpha2 net/wireless/reg.c:3424 [inline]
WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516
Modules linked in:
CPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events_power_efficient crda_timeout_work
RIP: 0010:is_user_regdom_saved net/wireless/reg.c:440 [inline]
RIP: 0010:restore_alpha2 net/wireless/reg.c:3424 [inline]
RIP: 0010:restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516
...
Call Trace:
 <TASK>
 crda_timeout_work+0x27/0x50 net/wireless/reg.c:542
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f2/0x390 kernel/kthread.c:389
 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

The Linux kernel CVE team has assigned CVE-2025-21910 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.34 with commit 09d989d179d0c679043556dda77c51b41a2dae7e and fixed in 5.4.291 with commit 62b1a9bbfebba4b4c2bb6c1ede9ef7ecee7a9ff6
	Issue introduced in 2.6.34 with commit 09d989d179d0c679043556dda77c51b41a2dae7e and fixed in 5.10.235 with commit da3f599517ef2ea851208df3229d07728d238dc5
	Issue introduced in 2.6.34 with commit 09d989d179d0c679043556dda77c51b41a2dae7e and fixed in 5.15.179 with commit 6a5e3b23054cee3b92683d1467e3fa83921f5622
	Issue introduced in 2.6.34 with commit 09d989d179d0c679043556dda77c51b41a2dae7e and fixed in 6.1.131 with commit f4112cb477c727a65787a4065a75ca593bb5b2f4
	Issue introduced in 2.6.34 with commit 09d989d179d0c679043556dda77c51b41a2dae7e and fixed in 6.6.83 with commit 35ef07112b61b06eb30683a6563c9f6378c02476
	Issue introduced in 2.6.34 with commit 09d989d179d0c679043556dda77c51b41a2dae7e and fixed in 6.12.19 with commit be7c5f00aa7f1344293e4d48d0e12be83a2f223d
	Issue introduced in 2.6.34 with commit 09d989d179d0c679043556dda77c51b41a2dae7e and fixed in 6.13.7 with commit 17aa34c84867f6cd181a5743e1c647e7766962a6
	Issue introduced in 2.6.34 with commit 09d989d179d0c679043556dda77c51b41a2dae7e and fixed in 6.14 with commit 59b348be7597c4a9903cb003c69e37df20c04a30

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21910
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/wireless/reg.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/62b1a9bbfebba4b4c2bb6c1ede9ef7ecee7a9ff6
	https://git.kernel.org/stable/c/da3f599517ef2ea851208df3229d07728d238dc5
	https://git.kernel.org/stable/c/6a5e3b23054cee3b92683d1467e3fa83921f5622
	https://git.kernel.org/stable/c/f4112cb477c727a65787a4065a75ca593bb5b2f4
	https://git.kernel.org/stable/c/35ef07112b61b06eb30683a6563c9f6378c02476
	https://git.kernel.org/stable/c/be7c5f00aa7f1344293e4d48d0e12be83a2f223d
	https://git.kernel.org/stable/c/17aa34c84867f6cd181a5743e1c647e7766962a6
	https://git.kernel.org/stable/c/59b348be7597c4a9903cb003c69e37df20c04a30

Powered by blists - more mailing lists