Date: Thu, 14 Nov 2013 23:03:34 +0100 From: "Mathy Vanhoef" <Mathy.Vanhoef@...kuleuven.be> To: <oss-security@...ts.openwall.com> Subject: CVE request: ath9k_htc improperly updates MAC address Hi, This concerns a bug in the ath9k_htc driver: When a user changes/spoofs their MAC address, an attacker can retrieve the original MAC address, which is a potential privacy risk. Debian bug report: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729573 Background of the bug: http://www.mathyvanhoef.com/2013/11/unmasking-spoofed-mac-address.html The cause of the bug is in ath9k_htc_set_bssid_mask . Here the MAC address of one of the virtual interfaces should be picked as the new main MAC address of the device. However the main MAC address (stored in common->macaddr) is never updated. The ath9k does implement this properly and sets the main MAC address to the MAC address of one of the virtual interfaces (by first writing it to iter_data->hw_macaddr and then copying it over to common->macaddr ). Note that ath_hw_setbssidmask updates the main MAC address register for both the ath9k and ath9k_htc drivers . Can a CVE please be assigned? Cheers, Mathy  <http://lxr.free-electrons.com/source/drivers/net/wireless/ath/ath9k/htc_drv _main.c?a=microblaze#L145> http://lxr.free-electrons.com/source/drivers/net/wireless/ath/ath9k/htc_drv_ main.c?a=microblaze#L145  <http://lxr.free-electrons.com/source/drivers/net/wireless/ath/ath9k/main.c# L831> http://lxr.free-electrons.com/source/drivers/net/wireless/ath/ath9k/main.c#L 831  <http://lxr.free-electrons.com/source/drivers/net/wireless/ath/hw.c#L118> http://lxr.free-electrons.com/source/drivers/net/wireless/ath/hw.c#L118 Disclaimer: http://www.kuleuven.be/cwis/email_disclaimer.htm
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.