[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CABz=zMLEVKD8pED=fGH8hzVzMscZPsvKT9Tb-5oQSeerV-pLTQ@mail.gmail.com>
Date: Tue, 14 Mar 2023 10:34:35 +0900
From: Jisoo Jang <jisoo.jang@...sei.ac.kr>
To: oss-security@...ts.openwall.com
Cc: Dokyung Song <dokyungs@...sei.ac.kr>, Minsuk Kang <linuxlovemin@...sei.ac.kr>
Subject: Re: A USB-accessible slab-out-of-bounds read in Linux kernel driver
This bug was assigned CVE-2023-1380.Best,
Jisoo
On Mon, Mar 13, 2023 at 8:10 PM Jisoo Jang <jisoo.jang@...sei.ac.kr> wrote:
> === Description ===
>
> A slab-out-of-bounds read bug was found in the Broadcom Full MAC Wi-Fi
> driver (e.g., brcmfmac.ko in the linux-modules-extra package in Ubuntu),
>
> The bug occurs in kmemdup() called from brcmf_get_assoc_ies(), when
> assoc_info->req_len, data from a URB provided by a USB device, is bigger
> than the size of buffer which is defined as WL_EXTRA_BUF_MAX.
>
> The driver duplicates the data of cfg->extra_buf to conn_info->req_ie as
> much as assoc_info->req_le, which could exceed the size of the buffer.
>
> The data passes through cfg80211_connect_done(),
> __cfg80211_connect_result(); in the end, it reaches
> nl80211_send_connect_result() that will form netlink messages with the data
> read outside the bounds of the buffer.
>
> This data, which may contain sensitive information in the kernel, could be
> sent to a userspace socket by __netlink_sendskb() during this multicasting
> process.
>
> === Fix ===
>
> A patch was reported to the linux wireless mailing list and successfully
> reviewed by the maintainer.
>
> (
> https://lore.kernel.org/linux-wireless/20230309104457.22628-1-jisoo.jang@yonsei.ac.kr/T/#u
> )
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
