mac80211: Limit Injected VHT MCS/NSS in ieee80211_parse_tx_radiotap
Summary
GSD-2021-1001561: mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap. Affects Kernel versions >= 646e76bb5daf4ca38438c69ffb72cccb605f3466, < 76538c7b4df314bb937e44c5cb1782f37d47443c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mac80211 package is a subsystem in the Linux Kernel that provides the implementation of the IEEE 802.11 wireless networking stack. It is responsible for managing wireless network interfaces and handling various aspects of wireless communication. The package includes functionality for parsing and processing radiotap headers, which are used to encapsulate additional information about wireless frames.
The vulnerability identified in mac80211 allows for the injection of malicious values for the VHT MCS/NSS (Very High Throughput Modulation and Coding Scheme/Number of Spatial Streams) fields in the radiotap header. This can lead to potential security issues and impact the integrity and performance of wireless communication.
Vulnerability Detail
The vulnerability arises from a lack of proper validation and limitation of the injected VHT MCS/NSS values in the ieee80211_parse_tx_radiotap function of mac80211. An attacker could exploit this by injecting arbitrary or out-of-range values, potentially causing buffer overflows, memory corruption, or other unexpected behavior.
The impact of this vulnerability could include denial of service (DoS) attacks, privilege escalation, information disclosure, or the execution of arbitrary code. The specific consequences depend on the context in which the vulnerable code is executed.
The vulnerability was introduced in version v4.7 of the Linux Kernel and was fixed in version v4.19.209 by commit 76538c7b4df314bb937e44c5cb1782f37d47443c.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch manually to their Linux Kernel version v4.7 or later. The patch can be obtained from the commit 76538c7b4df314bb937e44c5cb1782f37d47443c in the Linux Kernel repository.
Conclusion
The mac80211 package in the Linux Kernel is vulnerable to an issue that allows for the injection of malicious values in the VHT MCS/NSS fields of radiotap headers. This vulnerability can have serious consequences, including DoS attacks, privilege escalation, and arbitrary code execution. It is crucial to update the Linux Kernel to version v4.19.209 or later to mitigate this vulnerability. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
mac80211 is a subsystem in the Linux Kernel that provides the implementation of the IEEE 802.11 wireless networking stack.
The impact of this vulnerability could include denial of service (DoS) attacks, privilege escalation, information disclosure, or the execution of arbitrary code.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.19.209 or later.
Yes, users can manually apply the patch provided in the commit 76538c7b4df314bb937e44c5cb1782f37d47443c to their Linux Kernel version v4.7 or later.
This vulnerability was introduced in version v4.7 of the Linux Kernel and was fixed in version v4.19.209 by commit 76538c7b4df314bb937e44c5cb1782f37d47443c.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
