Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 4 Jun 2019 16:37:21 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: huangwen <huangwen@...usgroup.com.cn>
Subject: Re: Marvell Wifi Driver mwifiex_uap_parse_tail_ies Heap Overflow

On Sat, Jun 01, 2019 at 06:07:57PM +0800, huangwen wrote:
> There is heap-based buffer overflow in marvell wifi chip driver in Linux
> kernel,allows local users to cause a denial of service(system crash) or
> possibly execute arbitrary code.

> The problem is inside mwifiex_uap_parse_tail_ies function in
> drivers/net/wireless/marvell/mwifiex/ie.c. 
> 
> There are two memcpy in this function.The memcpy in while loop will be
> called when element_id is not equal to WLAN_EID_SSID,WLAN_EID_SUPP_RATES
> etc.
> 
> The copy dst buffer gen_ie->ie_buffer is a array with size
> IEEE_MAX_IE_SIZE(256), the src buffer is element in cfg80211_beacon_data
> from user space. 
> 
> There is not len check for two memcpy in this function.
> 
> If special elements are constructed (E.g.
> WLAN_EID_SUPPORTED_OPERATING_CLASSES) to make memcpy called repeatedly, will
> finally trigger the overflow.

This is now CVE-2019-10126.

> https://lore.kernel.org/linux-wireless/20190531131841.7552-1-tiwai@suse.de

Alexander

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.