04045f98e0
Reported by Chris Evans <scarybeasts@gmail.com>: > The summary is that an evil 80211 frame can crash out a victim's > machine. It only applies to drivers using the 80211 wireless code, and > only then to certain drivers (and even then depends on a card's > firmware not dropping a dubious packet). I must confess I'm not > keeping track of Linux wireless support, and the different protocol > stacks etc. > > Details are as follows: > > ieee80211_rx() does not explicitly check that "skb->len >= hdrlen". > There are other skb->len checks, but not enough to prevent a subtle > off-by-two error if the frame has the IEEE80211_STYPE_QOS_DATA flag > set. > > This leads to integer underflow and crash here: > > if (frag != 0) > flen -= hdrlen; > > (flen is subsequently used as a memcpy length parameter). How about this? Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| softmac | ||
| ieee80211_crypt.c | ||
| ieee80211_crypt_ccmp.c | ||
| ieee80211_crypt_tkip.c | ||
| ieee80211_crypt_wep.c | ||
| ieee80211_geo.c | ||
| ieee80211_module.c | ||
| ieee80211_rx.c | ||
| ieee80211_tx.c | ||
| ieee80211_wx.c | ||
| Kconfig | ||
| Makefile | ||