oss-security - CVE request: kernel: mac80211: fix two remote exploits

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4B14A1F4.3050009@kernel.sg>
Date: Tue, 01 Dec 2009 12:56:20 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: kernel: mac80211: fix two remote exploits

http://git.kernel.org/linus/4253119acf412fd686ef4bd8749b5a4d70ea3a51

"Lennert Buytenhek noticed a remotely triggerable problem in mac80211, 
which is due to some code shuffling I did that ended up changing the 
order in which things were done -- this was in

   commit d75636ef9c1af224f1097941879d5a8db7cd04e5
   Author: Johannes Berg <johannes@...solutions.net>
   Date:   Tue Feb 10 21:25:53 2009 +0100

     mac80211: RX aggregation: clean up stop session

The problem is that the BUG_ON moved before the various checks, and as 
such can be triggered.

As the comment indicates, the BUG_ON can be removed since the 
ampdu_action callback must already exist when the state is OPERATIONAL.

A similar code path leads to a WARN_ON in ieee80211_stop_tx_ba_session, 
which can also be removed."

Btw, FYI, there's another issue that was also introduced by the same 
code shuffling patch (commit d75636ef) but was fixed in another patch 
(commit 827d42c9). It was assigned with CVE-2009-4026.

Thanks, Eugene
-- 
Eugene Teo / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.