Vulnerability in mt76 DMA Initialization in Kernel
Summary
GSD-2022-1001071: mt76: dma: initialize skip_unmap in mt76_dma_rx_fill. Affects Kernel versions < 96ce2f14cf6d8f1b1bde08c0b07648696217b81d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mt76 package is a driver for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, and MT7628 wireless LAN chips. It provides support for various features and functionalities of these chips, including DMA (Direct Memory Access) operations. DMA is used for efficient data transfer between devices and memory without involving the CPU. However, a vulnerability has been identified in the mt76_dma_rx_fill function, which is responsible for initializing the DMA receive buffer. This vulnerability can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition.
Vulnerability Detail
The vulnerability in mt76_dma_rx_fill arises from the uninitialized skip_unmap variable. This variable is used to determine whether to unmap the DMA buffer after processing the received data. By not initializing this variable, the driver may incorrectly unmap the buffer, leading to memory corruption or other unexpected behavior. An attacker can potentially exploit this vulnerability by sending specially crafted packets to the affected device, triggering the uninitialized variable and causing a buffer overflow or other memory-related issues. The impact of this vulnerability can range from arbitrary code execution to system crashes or instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected wireless LAN chip or module to prevent potential exploitation of this vulnerability. This can be done by unloading the mt76 module or disabling the corresponding hardware. However, this workaround may result in the loss of wireless connectivity until the vulnerability is properly addressed.
Conclusion
The vulnerability in mt76 DMA initialization can lead to memory corruption, arbitrary code execution, or system instability. It is crucial to update the Linux Kernel to the recommended version or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
mt76 is a driver package for MediaTek wireless LAN chips, providing support for various features and functionalities of these chips.
DMA (Direct Memory Access) is a mechanism used for efficient data transfer between devices and memory without involving the CPU.
mt76_dma_rx_fill is a function in the mt76 driver responsible for initializing the DMA receive buffer.
The impact of this vulnerability can range from arbitrary code execution to system crashes or instability.
To fix this vulnerability, update the Linux Kernel to version v5.17.3 or later, which includes the necessary fix for the mt76 driver.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
