oss-security - CVE request: ath9k_htc improperly updates MAC address

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <000001cee185$5db2ec30$1918c490$@cs.kuleuven.be>
Date: Thu, 14 Nov 2013 23:03:34 +0100
From: "Mathy Vanhoef" <Mathy.Vanhoef@...kuleuven.be>
To: <oss-security@...ts.openwall.com>
Subject: CVE request: ath9k_htc improperly updates MAC address

Hi,

This concerns a bug in the ath9k_htc driver: When a user changes/spoofs
their MAC address, an attacker can retrieve the original MAC address, which
is a potential privacy risk. Debian bug report:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729573

Background of the bug:
http://www.mathyvanhoef.com/2013/11/unmasking-spoofed-mac-address.html

The cause of the bug is in ath9k_htc_set_bssid_mask [1]. Here the MAC
address of one of the virtual interfaces should be picked as the new main
MAC address of the device. However the main MAC address (stored in
common->macaddr) is never updated. The ath9k does implement this properly
and sets the main MAC address to the MAC address of one of the virtual
interfaces (by first writing it to iter_data->hw_macaddr and then copying it
over to common->macaddr [2]). Note that ath_hw_setbssidmask updates the main
MAC address register for both the ath9k and ath9k_htc drivers [3].

Can a CVE please be assigned?

Cheers,

Mathy

[1]
<http://lxr.free-electrons.com/source/drivers/net/wireless/ath/ath9k/htc_drv
_main.c?a=microblaze#L145>
http://lxr.free-electrons.com/source/drivers/net/wireless/ath/ath9k/htc_drv_
main.c?a=microblaze#L145

[2]
<http://lxr.free-electrons.com/source/drivers/net/wireless/ath/ath9k/main.c#
L831>
http://lxr.free-electrons.com/source/drivers/net/wireless/ath/ath9k/main.c#L
831

[3]
<http://lxr.free-electrons.com/source/drivers/net/wireless/ath/hw.c#L118>
http://lxr.free-electrons.com/source/drivers/net/wireless/ath/hw.c#L118

Disclaimer: http://www.kuleuven.be/cwis/email_disclaimer.htm

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.