Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <7FA714F2-4FFA-4781-A2B8-8F18A7EC8015@gmail.com>
Date: Fri, 22 Nov 2019 20:51:31 +0800
From: qize wang <wangqize888888888@...il.com>
To: oss-security@...ts.openwall.com
Cc: linux-distros 、 <linux-distros@...openwall.org>,
 amitkarwar 、 <amitkarwar@...il.com>,
 nishants 、 <nishants@...vell.com>,
 gbhat 、 <gbhat@...vell.com>,
 huxinming820 、 <huxinming820@...il.com>,
 kvalo 、 <kvalo@...eaurora.org>,
 greg 、 <greg@...ah.com>,
 security 、 <security@...nel.org>,
 "dan.carpenter" <dan.carpenter@...cle.com>,
 Solar Designer <solar@...nwall.com>
Subject: Linux kernel: heap overflow in the marvell wifi driver

Hi,
There are some heap overflows in marvell wifi chip driver in Linux
kernel, allow remote users to cause a denial of service(system crash) or
possibly execute arbitrary code.

Description
==========

some flaws were found in the Linux kernel's Marvell wifi chip driver. 
multi heap overflow in mwifiex_process_tdls_action_frame function in 
marvell/mwifiex/tdls.c which allows remote attackers to cause a denial 
of service(system crash) or execute arbitrary code.

the station receive a tdls setup request or respone frame which IE 's 
length is larger than the heap buffer assigned (for example : the 
EID_SUPP_RATES IE's length > 255) will cause heap overflow。


struct mwifiex_tdls_capab {
	__le16 capab;
	u8 rates[32];
	u8 rates_len;
	u8 qos_info;
	u8 coex_2040;
	u16 aid;
	struct ieee80211_ht_cap ht_capb;
	struct ieee80211_ht_operation ht_oper;
	struct ieee_types_extcap extcap;
	struct ieee_types_generic rsn_ie;
	struct ieee80211_vht_cap vhtcap;
	struct ieee80211_vht_operation vhtoper;
};

int mwifiex_process_rx_packet -> mwifiex_process_tdls_action_frame
(struct mwifiex_private *priv,
				       u8 *buf, int len)
{
.... 
case WLAN_EID_SUPP_RATES:
			sta_ptr->tdls_cap.rates_len = pos[1];   ;attacker can control 
			                                        ;EID_SUPP_RATES IE 's length
			for (i = 0; i < pos[1]; i++)
				sta_ptr->tdls_cap.rates[i] = pos[i + 2];
			break;
…
case WLAN_EID_EXT_SUPP_RATES:
			basic = sta_ptr->tdls_cap.rates_len;
			for (i = 0; i < pos[1]; i++)						;attacker can control 
													;EID_SUPP_RATES IE 's length
				sta_ptr->tdls_cap.rates[basic + i] = pos[i + 2];    
			sta_ptr->tdls_cap.rates_len += pos[1];  
			break;
…
case WLAN_EID_EXT_CAPABILITY:
			memcpy((u8 *)&sta_ptr->tdls_cap.extcap, pos,
			       sizeof(struct ieee_types_header) +
			       min_t(u8, pos[1], 8));       ;extcap is tlv struct, 
			       						;memcpy will cause a fata 
			       						;len(p[1]) into extcap
			break;
case WLAN_EID_RSN:
			memcpy((u8 *)&sta_ptr->tdls_cap.rsn_ie, pos,
			       sizeof(struct ieee_types_header) +
			       min_t(u8, pos[1], IEEE_MAX_IE_SIZE -
				     sizeof(struct ieee_types_header)); rsn_ie is tlv struct ,
											  ;memcpy will cause a fata 
											  ;len(p[1]) into rsn_ie

}

Patch
==========
https://patchwork.kernel.org/patch/11257535/

Credit
==========
This issue was discovered by wangqize(ADLab of VenusTech),huawen(ADLab of VenusTech)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.