linux-kernel - Re: 2.6.18-mm1 -- ieee80211: Info elem: parse failed: info_element->len + 2 > left : info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 27 Sep 2006 13:47:18 -0700
From:	James Ketrenos <jketreno@...ux.intel.com>
To:	Miles Lane <miles.lane@...il.com>
CC:	Andrew Morton <akpm@...l.org>, LKML <linux-kernel@...r.kernel.org>,
	Jouni Malinen <jkmaline@...hut.fi>
Subject: Re: 2.6.18-mm1 -- ieee80211: Info elem: parse failed: info_element->len
 + 2 > left : info_element->len+2=28 left=9, id=221.

Miles Lane wrote:
> It occurs to me that these messages occured while I was connected to a
> public WIFI AP at the airport in Phoenix.  It may be that the network
> configuration or my distance from the AP had a part to play in the
> messages being triggered.  If so, I may have trouble reproducing the
> problem.  I'll be interested to hear from some of the IEEE80211
> developers on what these messages indicate.
> ieee80211: Info elem: parse failed: info_element->len + 2 > left :
> info_element->len+2=28 left=9, id=221.
> ieee80211: Info elem: parse failed: info_element->len + 2 > left :
> info_element->len+2=28 left=9, id=221.
> ieee80211: Info elem: parse failed: info_element->len + 2 > left :
> info_element->len+2=28 left=9, id=221.

Without the actual full data frame it is difficult to determine the root
cause (faulty AP, wireless attack, or bug in ieee80211_rx.c).  If you
happen to find yourself in a situation where this occurs repeatedly, try
performing a packet capture w/ ethereal or similar to grab the packet.  
If ethereal can parse the frame correctly but you still see the message
from ieee80211, chances are its a bug in ieee80211_parse_info_param.

If you don't have ethereal, you can use the attached untested (beyond
build) patch against ieee80211_rx.c to dump the frame to the kernel log
(borrows the printk_buf function from ipw2200.c).   From that raw frame
dump we should be able to figure out if its a bug
ieee80211_parse_info_param or a bogus over the air packet.

James

View attachment "ieee80211-frame-dump.patch" of type "text/x-patch" (2757 bytes)