netdev - Re: [PATCH V2] brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20170712.082853.1710711458527879433.davem@davemloft.net>
Date:   Wed, 12 Jul 2017 08:28:53 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     arend.vanspriel@...adcom.com
Cc:     netdev@...r.kernel.org, linux-wireless@...r.kernel.org,
        torvalds@...ux-foundation.org
Subject: Re: [PATCH V2] brcmfmac: fix possible buffer overflow in
 brcmf_cfg80211_mgmt_tx()

From: Arend van Spriel <arend.vanspriel@...adcom.com>
Date: Wed, 12 Jul 2017 13:49:23 +0200

> On 7/7/2017 10:09 PM, Arend van Spriel wrote:
>> The lower level nl80211 code in cfg80211 ensures that "len" is between
>> 25 and NL80211_ATTR_FRAME (2304).  We subtract DOT11_MGMT_HDR_LEN (24)
>> from
>> "len" so thats's max of 2280.  However, the action_frame->data[]
>> buffer is
>> only BRCMF_FIL_ACTION_FRAME_SIZE (1800) bytes long so this memcpy()
>> can
>> overflow.
>>
>> 	memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
>> 	       le16_to_cpu(action_frame->len));
>>
>> Cc: stable@...r.kernel.org # 3.9.x
>> Fixes: 18e2f61db3b70 ("brcmfmac: P2P action frame tx.")
>> Reported-by: "freenerguo(郭大兴)" <freenerguo@...cent.com>
>> Signed-off-by: Arend van Spriel <arend.vanspriel@...adcom.com>
>> ---
>>   V2:
>>    - added Fixes: tag and Cc: for stable kernels.
>>    - Cc: patch to netdev list.
>> ---
>> Hi David,
>>
>> Here is the patch as Linus send it to us and security@...nel.org. I
>> removed the lower bound check as that is already done in cfg80211.
>> Now I signed off on the patch although formally I suppose Linus should
>> sign it off. Putting it out there so people can respond as deemed
>> necessary.
>>
>> The reason for submitting it to your tree is the fact that Kalle is
>> on vacation for next 10 days or so which was indicated to me by
>> Johannes.
>> The patch applies to the master branch of your net repository. For
>> reference V1 of this patch can be found here [1].
> 
> Hi Dave,
> 
> Not sure if you missed this one. It is addressing a reported security
> issue and intended for the net repository, not net-next which is
> obviously closed [2].

Thanks for pointing this out to me, I'll take care of it.