From patchwork Wed Feb 8 21:27:36 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yuxuan Luo X-Patchwork-Id: 1739698 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=a19hkgcL; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4PBtQ81CrSz23j7 for ; Thu, 9 Feb 2023 08:27:58 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1pPryl-00040M-A9; Wed, 08 Feb 2023 21:27:47 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1pPryh-0003zr-GK for kernel-team@lists.ubuntu.com; Wed, 08 Feb 2023 21:27:43 +0000 Received: from mail-qk1-f200.google.com (mail-qk1-f200.google.com [209.85.222.200]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 315953F1F4 for ; Wed, 8 Feb 2023 21:27:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1675891663; bh=auWxETakQNOUR8s4q2f4wJIDCfYstPqusZt4aZZrUBg=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=a19hkgcLuvAF7kaN3z2B0cWN5OHjVpM2yFjNX5LBjwYKiIUVXT29SWbzn+LuJnSmk 1Ue2qHrsOxS9g5MOlHefLCHl6vS0PB6g00+t1CG42Xx1NjVD3ZwtpbFe1taNzzq4sC Igjzui5KFzVcqN/vSN7hue43QhKTxypmr2O1bp/1+wR3hcAI6/U/m+ldCIkMoDYerh 2P0XMODmPub6iGIO/iwRSInxSf9YCxjdCe258SmJewf/RNhA5/L8zw70QN08ptJu18 ipbxOpuPTKbsr3heRX8V6whdPr504QDulAbxa+u5+DIkqDU51P0T1ahRDMimYgML4X S95aBPWcO/Hmg== Received: by mail-qk1-f200.google.com with SMTP id j10-20020a05620a288a00b0070630ecfd9bso13160060qkp.20 for ; Wed, 08 Feb 2023 13:27:43 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=auWxETakQNOUR8s4q2f4wJIDCfYstPqusZt4aZZrUBg=; b=lLuiWkYZhZWB60Fjs0e3gTMotMWk3uzIarCVEYM0OQTltTAzuLDNiHkLufBFmHkNtD wU+9wky4NfLORotvaAjNh74FcaWykIbQ2CeHNXciY2aPuJelhPgrRiyNNOuXzKs9+90c SGSyChOcurLs0DQMBE36RO2W4u6X5Jw3VZKkqE7gjb5WTJ8S7vf51g0FkGs4/HFBa++N CEmCvqg2ENsHCgu4m0qDUVdWhOd788BeJ6NHJZO8yc0yFiRUtIOWMyz+A/YCf2cU/Z8s d5J4QsxIAPBLB8N0Hrc41WgQGN0YjrzrL4w5Wo14ayCo+FlRXD8rB3kykmilA9JxLAb3 b5+w== X-Gm-Message-State: AO0yUKXOxbOw2CQuoiTyBiifnQP4uuvtuGFsoeQEdDrhY0zvKa5G9bDG nGw2RNmGFFf5pPFcxASYazJtYt1Tl8Fel7mzAvTCgRbvd9l18v9YuwSlMXCXuyU3bvJengqzjxo fNPwwRuKg/y2Q1TdtGrg15/cJHy+YGE8t2WbJhVexKAKLl1c= X-Received: by 2002:ad4:4ee9:0:b0:537:6902:cddb with SMTP id dv9-20020ad44ee9000000b005376902cddbmr16574450qvb.28.1675891661455; Wed, 08 Feb 2023 13:27:41 -0800 (PST) X-Google-Smtp-Source: AK7set8jPJBzhr9ZoiHxm+vCM+8gh/i80/gi/UR5F41pdbE2axYr9663hNdRNfSSxJtyAXZR9XkTnw== X-Received: by 2002:ad4:4ee9:0:b0:537:6902:cddb with SMTP id dv9-20020ad44ee9000000b005376902cddbmr16574421qvb.28.1675891661188; Wed, 08 Feb 2023 13:27:41 -0800 (PST) Received: from cache-ubuntu.hsd1.nj.comcast.net ([2601:86:200:98b0:557e:3300:8a54:b2d0]) by smtp.gmail.com with ESMTPSA id el18-20020a05622a431200b003a81eef14efsm12013465qtb.45.2023.02.08.13.27.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Feb 2023 13:27:40 -0800 (PST) From: Yuxuan Luo To: kernel-team@lists.ubuntu.com Subject: [OEM-5.14/5.17/6.0][PATCH] wifi: wilc1000: validate pairwise and authentication suite offsets Date: Wed, 8 Feb 2023 16:27:36 -0500 Message-Id: <20230208212736.14269-2-yuxuan.luo@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230208212736.14269-1-yuxuan.luo@canonical.com> References: <20230208212736.14269-1-yuxuan.luo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Phil Turnbull There is no validation of 'offset' which can trigger an out-of-bounds read when extracting RSN capabilities. Signed-off-by: Phil Turnbull Tested-by: Ajay Kathat Acked-by: Ajay Kathat Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20221123153543.8568-2-philipturnbull@github.com (cherry picked from commit cd21d99e595ec1d8721e1058dcdd4f1f7de1d793) CVE-2022-47520 Signed-off-by: Yuxuan Luo --- drivers/net/wireless/microchip/wilc1000/hif.c | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c index a133736a7821..3e5cc947b9b9 100644 --- a/drivers/net/wireless/microchip/wilc1000/hif.c +++ b/drivers/net/wireless/microchip/wilc1000/hif.c @@ -467,14 +467,25 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len); if (rsn_ie) { + int rsn_ie_len = sizeof(struct element) + rsn_ie[1]; int offset = 8; - param->mode_802_11i = 2; - param->rsn_found = true; /* extract RSN capabilities */ - offset += (rsn_ie[offset] * 4) + 2; - offset += (rsn_ie[offset] * 4) + 2; - memcpy(param->rsn_cap, &rsn_ie[offset], 2); + if (offset < rsn_ie_len) { + /* skip over pairwise suites */ + offset += (rsn_ie[offset] * 4) + 2; + + if (offset < rsn_ie_len) { + /* skip over authentication suites */ + offset += (rsn_ie[offset] * 4) + 2; + + if (offset + 1 < rsn_ie_len) { + param->mode_802_11i = 2; + param->rsn_found = true; + memcpy(param->rsn_cap, &rsn_ie[offset], 2); + } + } + } } if (param->rsn_found) {