src/patches/linux/linux-5.15-wifi-security-patches-14.patch

   1 From de124365a7d2deed22cf706583930f28d537ff0f Mon Sep 17 00:00:00 2001
   2 From: Johannes Berg <johannes.berg@intel.com>
   3 Date: Thu, 13 Oct 2022 20:16:01 +0200
   4 Subject: [PATCH] wifi: mac80211: fix MBSSID parsing use-after-free
   5
   6 commit ff05d4b45dd89b922578dac497dcabf57cf771c6
   7
   8 When we parse a multi-BSSID element, we might point some
   9 element pointers into the allocated nontransmitted_profile.
  10 However, we free this before returning, causing UAF when the
  11 relevant pointers in the parsed elements are accessed.
  12
  13 Fix this by not allocating the scratch buffer separately but
  14 as part of the returned structure instead, that way, there
  15 are no lifetime issues with it.
  16
  17 The scratch buffer introduction as part of the returned data
  18 here is taken from MLO feature work done by Ilan.
  19
  20 This fixes CVE-2022-42719.
  21
  22 Fixes: 5023b14cf4df ("mac80211: support profile split between elements")
  23 Co-developed-by: Ilan Peer <ilan.peer@intel.com>
  24 Signed-off-by: Ilan Peer <ilan.peer@intel.com>
  25 Reviewed-by: Kees Cook <keescook@chromium.org>
  26 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  27 Cc: Felix Fietkau <nbd@nbd.name>
  28 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  29 ---
  30  net/mac80211/ieee80211_i.h |  8 ++++++++
  31  net/mac80211/util.c        | 29 ++++++++++++++---------------
  32  2 files changed, 22 insertions(+), 15 deletions(-)
  33
  34 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
  35 index 3633e49239c7..21549a440b38 100644
  36 --- a/net/mac80211/ieee80211_i.h
  37 +++ b/net/mac80211/ieee80211_i.h
  38 @@ -1613,6 +1613,14 @@ struct ieee802_11_elems {
  39
  40         /* whether a parse error occurred while retrieving these elements */
  41         bool parse_error;
  42 +
  43 +       /*
  44 +        * scratch buffer that can be used for various element parsing related
  45 +        * tasks, e.g., element de-fragmentation etc.
  46 +        */
  47 +       size_t scratch_len;
  48 +       u8 *scratch_pos;
  49 +       u8 scratch[];
  50  };
  51
  52  static inline struct ieee80211_local *hw_to_local(
  53 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
  54 index 2ac61e68b6b4..354badd32793 100644
  55 --- a/net/mac80211/util.c
  56 +++ b/net/mac80211/util.c
  57 @@ -1475,24 +1475,25 @@ struct ieee802_11_elems *ieee802_11_parse_elems_crc(const u8 *start, size_t len,
  58         u8 *nontransmitted_profile;
  59         int nontransmitted_profile_len = 0;
  60
  61 -       elems = kzalloc(sizeof(*elems), GFP_ATOMIC);
  62 +       elems = kzalloc(sizeof(*elems) + len, GFP_ATOMIC);
  63         if (!elems)
  64                 return NULL;
  65         elems->ie_start = start;
  66         elems->total_len = len;
  67
  68 -       nontransmitted_profile = kmalloc(len, GFP_ATOMIC);
  69 -       if (nontransmitted_profile) {
  70 -               nontransmitted_profile_len =
  71 -                       ieee802_11_find_bssid_profile(start, len, elems,
  72 -                                                     transmitter_bssid,
  73 -                                                     bss_bssid,
  74 -                                                     nontransmitted_profile);
  75 -               non_inherit =
  76 -                       cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
  77 -                                              nontransmitted_profile,
  78 -                                              nontransmitted_profile_len);
  79 -       }
  80 +       elems->scratch_len = len;
  81 +       elems->scratch_pos = elems->scratch;
  82 +
  83 +       nontransmitted_profile = elems->scratch_pos;
  84 +       nontransmitted_profile_len =
  85 +               ieee802_11_find_bssid_profile(start, len, elems,
  86 +                                             transmitter_bssid,
  87 +                                             bss_bssid,
  88 +                                             nontransmitted_profile);
  89 +       non_inherit =
  90 +               cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
  91 +                                      nontransmitted_profile,
  92 +                                      nontransmitted_profile_len);
  93
  94         crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
  95                                           crc, non_inherit);
  96 @@ -1521,8 +1522,6 @@ struct ieee802_11_elems *ieee802_11_parse_elems_crc(const u8 *start, size_t len,
  97             offsetofend(struct ieee80211_bssid_index, dtim_count))
  98                 elems->dtim_count = elems->bssid_index->dtim_count;
  99
 100 -       kfree(nontransmitted_profile);
 101 -
 102         elems->crc = crc;
 103
 104         return elems;
 105 --
 106 2.30.2
 107