mac80211: Fix Use-After-Free in CCMP/GCMP RX
Summary
GSD-2021-1001500: mac80211: fix use-after-free in CCMP/GCMP RX. Affects Kernel versions >= 608b0a2ae928a74a2f89e02227339dd79cdb63cf, < 447d001b875d0e7f211c4ba004916028da994258. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mac80211 package is a subsystem in the Linux Kernel that provides the implementation of the IEEE 802.11 wireless networking stack. It is responsible for managing wireless network interfaces and handling various operations such as frame transmission and reception. The CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) and GCMP (Galois/Counter Mode Protocol) are encryption algorithms used for securing wireless communication.
However, a vulnerability has been discovered in the mac80211 package that can lead to a use-after-free condition in the CCMP/GCMP RX (receive) process. This vulnerability allows an attacker to potentially exploit the use-after-free condition to execute arbitrary code or cause a denial-of-service (DoS) attack.
Vulnerability Detail
The vulnerability in mac80211 arises from a use-after-free condition in the CCMP/GCMP RX process. When processing CCMP/GCMP encrypted frames, the vulnerable code fails to properly handle memory deallocation, leading to a situation where a pointer to freed memory is still accessible. An attacker can exploit this by sending specially crafted wireless frames to a vulnerable system, causing the use-after-free condition to occur.
The impact of this vulnerability can be severe. An attacker who successfully exploits this vulnerability can execute arbitrary code with kernel privileges, potentially gaining full control over the affected system. Additionally, a successful attack can also lead to a denial-of-service situation, causing the system to crash or become unresponsive.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to apply the official patch or update the Linux Kernel to the latest version as soon as possible.
Conclusion
The mac80211 package in the Linux Kernel is vulnerable to a use-after-free condition in the CCMP/GCMP RX process. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial-of-service situation. It is crucial to update the Linux Kernel to the latest version or apply the official patch to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
mac80211 is a subsystem in the Linux Kernel that provides the implementation of the IEEE 802.11 wireless networking stack.
CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) and GCMP (Galois/Counter Mode Protocol) are encryption algorithms used for securing wireless communication.
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to memory corruption or arbitrary code execution.
The impact of this vulnerability can be severe. An attacker who successfully exploits this vulnerability can execute arbitrary code with kernel privileges or cause a denial-of-service situation.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.4.286 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
