netdev - Re: [PATCH] nl80211: 802.11: mesh: Handle Beacon/probe response IE length in cfg80211_notify_new_peer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2e0b6e7c1e97d57f392d7a3da843d1357a9a33f7.camel@sipsolutions.net>
Date:   Fri, 22 Nov 2019 13:39:36 +0100
From:   Johannes Berg <johannes@...solutions.net>
To:     Shashidhara C <shashidharac333@...il.com>, davem@...emloft.net,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] nl80211: 802.11: mesh: Handle Beacon/probe response IE
 length in cfg80211_notify_new_peer_candidate() for 80211ac/ax mode.

On Sat, 2019-11-16 at 15:55 +0530, Shashidhara C wrote:
> In function cfg80211_notify_new_peer_candidate(), beacon IE length (i.e. u8 ie_len) is not
> handled for processing 80211AC/AX beacon/probe response. ie_len can hold maximum 
> integer value of 255. In case of 80211AC/AX, the mesh beacon/probe response IE length 
> is more than 255, making ie_len to wrap around and causing failure while parsing
> beacon/probe response IEs in wpa_supplicant.
> 
> ie_len type in cfg80211_notify_new_peer_candidate() is modified to u16 to handle this issue.
> 
> Issue is found in v4.4.60, issue exists in latest v5.4.0-rc6. Verified the fix in v4.4.60.

[snip]

You cannot send patches as html email :)

johannes