Vulnerability in mac80211: fix skb length check in ieee80211_scan_rx()
Summary
UVI-2021-1001054: mac80211: fix skb length check in ieee80211_scan_rx(). Affects Kernel versions >= cd418ba63f0c2f6157f35a41c9accc6ecb52590a, < d1b949c70206178b12027f66edc088d40375b5cb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mac80211 package is a subsystem in the Linux Kernel that provides support for wireless LAN devices. It implements the IEEE 802.11 wireless networking standard and handles various operations related to scanning, transmitting, and receiving wireless packets. The vulnerability in mac80211 affects the skb length check in the ieee80211_scan_rx() function.
Vulnerability Detail
The vulnerability arises from a flawed skb length check in the ieee80211_scan_rx() function of mac80211. This vulnerability can potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code. By manipulating the skb length, an attacker may be able to trigger a buffer overflow or other memory corruption issues, leading to system instability or unauthorized code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in commit d1b949c70206178b12027f66edc088d40375b5cb manually to their Linux Kernel. The patch modifies the ieee80211_scan_rx() function to properly validate the skb length, preventing potential exploitation of the vulnerability. Here is an example of the patch:
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -1236,7 +1236,7 @@ static void ieee80211_scan_rx(struct ieee80211_local *local,
struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
struct ieee80211_scan_rx_data *rx = &sdata->scan_rx;
struct ieee80211_supported_band *sband;
- int len;
+ unsigned int len;
struct ieee80211_rx_status *status;
struct ieee80211_hdr *hdr;
struct ieee80211_mgmt *mgmt;
Conclusion
In conclusion, the vulnerability in mac80211's ieee80211_scan_rx() function can lead to a denial-of-service condition or arbitrary code execution. It is crucial to update the Linux Kernel to version v5.12.13 or later to mitigate this vulnerability. Applying the provided patch manually is also a viable workaround. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
mac80211 is a subsystem in the Linux Kernel that provides support for wireless LAN devices. It implements the IEEE 802.11 wireless networking standard and handles various operations related to scanning, transmitting, and receiving wireless packets.
This vulnerability can potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code. By manipulating the skb length, an attacker may be able to trigger a buffer overflow or other memory corruption issues, leading to system instability or unauthorized code execution.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.12.13 or later. The fix for this vulnerability was implemented in commit d1b949c70206178b12027f66edc088d40375b5cb. Updating to the latest version of the Linux Kernel will ensure that the skb length check in ieee80211_scan_rx() is correctly performed, mitigating the risk of exploitation.
Yes, users can apply the patch provided in commit d1b949c70206178b12027f66edc088d40375b5cb manually to their Linux Kernel. The patch modifies the ieee80211_scan_rx() function to properly validate the skb length, preventing potential exploitation of the vulnerability.
For more information about this vulnerability, you can refer to the source link: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/UVI-2021-1001054.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
