BACKPORT: wifi: mac80211: fix MBSSID parsing use-after-free
When we parse a multi-BSSID element, we might point some
element pointers into the allocated nontransmitted_profile.
However, we free this before returning, causing UAF when the
relevant pointers in the parsed elements are accessed.
Fix this by not allocating the scratch buffer separately but
as part of the returned structure instead, that way, there
are no lifetime issues with it.
The scratch buffer introduction as part of the returned data
here is taken from MLO feature work done by Ilan.
This fixes CVE-2022-42719.
Fixes: 5023b14cf4df ("mac80211: support profile split between elements")
Co-developed-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit ff05d4b45dd89b922578dac497dcabf57cf771c6)
Conflicts:
net/mac80211/util.c
Backport Note:
* The changes are made in drivers/net/wireless/iwl7000/mac80211/util.c
and drivers/net/wireless/iwl7000/mac80211/ieee80211_i.h; the upstream
commit makes the changes in net/mac80211/ieee80211_i.h and
net/mac80211/util.c.
* Upstream commit fixes the issue in ieee802_11_parse_elems_full(); this
commit fixes ieee802_11_parse_elems_crc().
BUG=b:254323097
TEST=CQ
Signed-off-by: Zubin Mithra <zsm@google.com>
Change-Id: I1050bd01c816d1a842ec186d2b6a6e17706ca56f
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/3979270
Tested-by: Zubin Mithra <zsm@chromium.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Commit-Queue: Guenter Roeck <groeck@chromium.org>
Auto-Submit: Zubin Mithra <zsm@chromium.org>
2 files changed
