linux-cve-announce - CVE-2025-37973: wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025052046-CVE-2025-37973-3687@gregkh>
Date: Tue, 20 May 2025 18:45:52 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-37973: wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation

Currently during the multi-link element defragmentation process, the
multi-link element length added to the total IEs length when calculating
the length of remaining IEs after the multi-link element in
cfg80211_defrag_mle(). This could lead to out-of-bounds access if the
multi-link element or its corresponding fragment elements are the last
elements in the IEs buffer.

To address this issue, correctly calculate the remaining IEs length by
deducting the multi-link element end offset from total IEs end offset.

The Linux kernel CVE team has assigned CVE-2025-37973 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.5 with commit 2481b5da9c6b2ee1fde55a1c29eb2ca377145a10 and fixed in 6.6.91 with commit 73dde269a1a43e6b1aa92eba13ad2df58bfdd38e
	Issue introduced in 6.5 with commit 2481b5da9c6b2ee1fde55a1c29eb2ca377145a10 and fixed in 6.12.29 with commit 9423f6da825172b8dc60d4688ed3d147291c3be9
	Issue introduced in 6.5 with commit 2481b5da9c6b2ee1fde55a1c29eb2ca377145a10 and fixed in 6.14.7 with commit e1c6d0c6199bd5f4cfc7a66ae7032b6e805f904d
	Issue introduced in 6.5 with commit 2481b5da9c6b2ee1fde55a1c29eb2ca377145a10 and fixed in 6.15-rc6 with commit 023c1f2f0609218103cbcb48e0104b144d4a16dc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-37973
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/wireless/scan.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/73dde269a1a43e6b1aa92eba13ad2df58bfdd38e
	https://git.kernel.org/stable/c/9423f6da825172b8dc60d4688ed3d147291c3be9
	https://git.kernel.org/stable/c/e1c6d0c6199bd5f4cfc7a66ae7032b6e805f904d
	https://git.kernel.org/stable/c/023c1f2f0609218103cbcb48e0104b144d4a16dc