kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net
History
HE WEI (ギカク) 24154c1722 wifi: cfg80211: bound element ID read when checking non-inheritance 
[ Upstream commit cb8afea465 ]

cfg80211_is_element_inherited() reads the first data octet of the
candidate element (id = elem->data[0]) to look it up in an extension
non-inheritance list. It does so after testing elem->id, but without
verifying that the element actually has a data octet. A zero-length
extension element (WLAN_EID_EXTENSION with length 0) therefore makes it
read one octet past the end of the element.

_ieee802_11_parse_elems_full() runs this check for every element of a
frame once a non-inheritance context exists -- e.g. while parsing a
per-STA profile of a Multi-Link element in a (re)association response,
or a non-transmitted BSS profile -- so a crafted frame from an AP can
trigger a one-octet slab-out-of-bounds read during element parsing:

  BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited
  Read of size 1 ... in net/wireless/scan.c

Return early (treat the element as inherited) when an extension element
carries no data, mirroring the existing handling of empty ID lists.

The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.

Fixes: f7dacfb114 ("cfg80211: support non-inheritance element")
Signed-off-by: HE WEI (ギカク) <skyexpoc@gmail.com>
Link: https://patch.msgid.link/20260707094828.16465-1-skyexpoc@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-08-19 17:13:53 +02:00
..
6lowpan 6lowpan: fix NHC entry use-after-free on error path 2026-07-24 15:51:20 +02:00
9p net/9p: fix infinite loop in p9_client_rpc on fatal signal 2026-07-24 15:51:50 +02:00
802 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr 2026-06-19 13:33:34 +02:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm net: atm: reject out-of-range traffic classes in QoS validation 2026-07-24 15:51:46 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: clean untagged VLAN on netdev registration failure 2026-07-24 15:51:53 +02:00
bluetooth Bluetooth: L2CAP: Fix regressions caused by reusing ident 2026-07-24 15:52:02 +02:00
bpf bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 2026-06-01 17:35:29 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge netfilter: ebtables: zero chainstack array 2026-07-24 15:51:58 +02:00
caif net: caif: clear client service pointer on teardown 2026-06-01 17:35:14 +02:00
can can: isotp: serialize TX state transitions under so->rx_lock 2026-08-19 17:13:52 +02:00
ceph use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
core rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag 2026-07-24 15:51:42 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths 2026-07-24 15:51:27 +02:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool ethtool: eeprom: add more safeties to EEPROM Netlink fallback 2026-06-19 13:33:24 +02:00
hsr net: hsr: defer node table free until after RCU readers 2026-06-19 13:33:46 +02:00
ieee802154 ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation 2026-07-24 15:51:53 +02:00
ife net: ife: require ETH_HLEN to be pullable in ife_decode() 2026-07-24 15:51:46 +02:00
ipv4 net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink 2026-07-24 15:51:53 +02:00
ipv6 net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink 2026-07-24 15:51:53 +02:00
iucv net/iucv: fix locking in .getsockopt 2026-06-19 13:33:23 +02:00
kcm kcm: use WRITE_ONCE() when changing lower socket callbacks 2026-07-24 15:51:36 +02:00
key net: af_key: initialize alg_key_len for IPComp states 2026-07-24 15:51:21 +02:00
l2tp l2tp: Drop large packets with UDP encap 2026-06-01 17:35:03 +02:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix SAP refcount leak when creating incoming sockets 2026-07-24 15:51:55 +02:00
mac80211 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock 2026-08-19 17:13:53 +02:00
mac802154 mac802154: remove interfaces with RCU list deletion 2026-07-24 15:51:54 +02:00
mctp net: mctp: fix don't require received header reserved bits to be zero 2026-06-19 13:33:41 +02:00
mpls inet: allow ip_valid_fib_dump_req() to be called with RTNL or RCU 2026-07-24 15:51:42 +02:00
mptcp mptcp: fix missing wakeups in edge scenarios 2026-07-04 13:39:40 +02:00
ncsi net: ncsi: fix skb leak in error paths 2026-04-18 10:33:15 +02:00
netfilter audit: add audit_log_nf_skb helper function 2026-07-24 15:52:02 +02:00
netlabel netlabel: validate unlabeled address and mask attribute lengths 2026-06-19 13:33:35 +02:00
netlink rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag 2026-07-24 15:51:42 +02:00
netrom netrom: fix double-free in nr_route_frame() 2026-02-06 16:41:58 +01:00
nfc nfc: llcp: protect nfc_llcp_sock_unlink() calls 2026-07-24 15:51:15 +02:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch net: openvswitch: reject oversized nested action attrs 2026-07-24 15:51:55 +02:00
packet net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() 2026-06-19 13:33:40 +02:00
phonet net: phonet: free phonet_device after RCU grace period 2026-07-04 13:39:41 +02:00
psample net: psample: fix info leak in PSAMPLE_ATTR_DATA 2026-07-24 15:51:39 +02:00
qrtr net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() 2026-07-24 15:51:46 +02:00
rds net: rds: clear i_sends on setup unwind 2026-06-19 13:33:38 +02:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-18 10:33:38 +02:00
rose net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect 2026-04-18 10:33:20 +02:00
rxrpc rxrpc: Fix missing validation of ticket length in non-XDR key preparsing 2026-06-01 17:35:12 +02:00
sched net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked 2026-07-24 15:51:54 +02:00
sctp sctp: validate STALE_COOKIE cause length before reading staleness 2026-07-24 15:51:51 +02:00
smc net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket 2026-07-24 15:51:44 +02:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-06-01 17:35:14 +02:00
sunrpc xprtrdma: Fix bcall rep leak and unbounded peek 2026-07-24 15:51:38 +02:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: fix UAF in tipc_l2_send_msg() 2026-07-24 15:51:36 +02:00
tls net: skmsg: preserve sg.copy across SG transforms 2026-07-24 15:51:16 +02:00
unix af_unix: Reject SIOCATMARK on non-stream sockets 2026-07-04 13:39:37 +02:00
vmw_vsock vsock/vmci: fix sk_ack_backlog leak on failed handshake 2026-06-19 13:33:37 +02:00
wireless wifi: cfg80211: bound element ID read when checking non-inheritance 2026-08-19 17:13:53 +02:00
x25 net/x25: Fix overflow when accumulating packets 2026-04-18 10:33:31 +02:00
xdp xsk: tighten UMEM headroom validation to account for tailroom and min frame 2026-06-01 17:35:02 +02:00
xfrm xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert 2026-08-19 17:13:52 +02:00
compat.c use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: Drop the lock in skb_may_tx_timestamp() 2026-07-24 15:51:21 +02:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00