mbox series

[SRU,L/K/J/F/B,0/1] CVE-2023-1380

Message ID 20230509190541.46028-1-yuxuan.luo@canonical.com
Headers show
Series CVE-2023-1380 | expand

Message

Yuxuan Luo May 9, 2023, 7:05 p.m. UTC 
[Impact]
A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in 
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux 
Kernel. This issue could occur when assoc_info->req_len data is bigger than 
the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of 
service. 

[Backport]
It is a clean cherry pick for L/K/J/F.
For Bionic, substitute `bphy_err()` with `brcmf_err()` since `bphy_err()` was
yet to be introduced in the Bionic tree.

[Test]
Compile and smoke tested via modprobe and rmmod the brmcfmac module.

[Potential Regression]
Expecting low potential of regression as the fix only adds an additionaly layer
of sanity check.

Jisoo Jang (1):
  wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()

 drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 5 +++++
 1 file changed, 5 insertions(+)

Comments

Tim Gardner May 10, 2023, 4:13 p.m. UTC | #1 
On 5/9/23 1:05 PM, Yuxuan Luo wrote:
> [Impact]
> A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux
> Kernel. This issue could occur when assoc_info->req_len data is bigger than
> the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of
> service.
> 
> [Backport]
> It is a clean cherry pick for L/K/J/F.
> For Bionic, substitute `bphy_err()` with `brcmf_err()` since `bphy_err()` was
> yet to be introduced in the Bionic tree.
> 
> [Test]
> Compile and smoke tested via modprobe and rmmod the brmcfmac module.
> 
> [Potential Regression]
> Expecting low potential of regression as the fix only adds an additionaly layer
> of sanity check.
> 
> Jisoo Jang (1):
>    wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
> 
>   drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Thadeu Lima de Souza Cascardo May 10, 2023, 6:58 p.m. UTC | #2 
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Luke Nowakowski-Krijger May 11, 2023, 4:04 p.m. UTC | #3 
Applied to lunar,kinetic,jammy,focal,bionic linux master-next

Thanks,

- Luke

On Tue, May 9, 2023 at 9:07 PM Yuxuan Luo <yuxuan.luo@canonical.com> wrote:

> [Impact]
> A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux
> Kernel. This issue could occur when assoc_info->req_len data is bigger
> than
> the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial
> of
> service.
>
> [Backport]
> It is a clean cherry pick for L/K/J/F.
> For Bionic, substitute `bphy_err()` with `brcmf_err()` since `bphy_err()`
> was
> yet to be introduced in the Bionic tree.
>
> [Test]
> Compile and smoke tested via modprobe and rmmod the brmcfmac module.
>
> [Potential Regression]
> Expecting low potential of regression as the fix only adds an additionaly
> layer
> of sanity check.
>
> Jisoo Jang (1):
>   wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
>
>  drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> --
> 2.34.1
>
>
> --
> kernel-team mailing list
> kernel-team@lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
>