Hauke Mehrtens
8614a2ba68
Cherry pick the patches recommended in the hostapd security advisory 2026-1: https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt Vulnerability Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE 802.11be/Wi-Fi 7) information has been identified in hostapd and wpa_supplicant. These issues show up in various cases where frames including information on affiliated links are parsed and processed in both AP and STA modes. The issues can result in process termination due to buffer read overflow checks and memory corruption. The issues for AP mode (hostapd or wpa_supplicant) can result in denial-of-service attacks due to process termination and small memory corruption that could theoretically cause other issues, but it does not seem likely that those could be exploiting in practice. Affected areas can be reached by sending invalid Management frames without needing authentication or user action on the target device. CVE-2026-58374 Link: https://github.com/openwrt/openwrt/pull/24043 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
39 lines
1.5 KiB
Diff
39 lines
1.5 KiB
Diff
From aa9d345887389a251c63a3781d2ad2940d079193 Mon Sep 17 00:00:00 2001
|
|
From: Amarnath Hullur Subramanyam <amarnathhs@google.com>
|
|
Date: Thu, 30 Apr 2026 18:24:35 -0700
|
|
Subject: BSS: Add bounds check for link_id in Basic MLE parsing
|
|
|
|
In wpa_bss_parse_basic_ml_element() in bss.c, an extracted link_id is
|
|
used without validation against the maximum allowed links
|
|
(MAX_NUM_MLD_LINKS). Processing a malformed Basic Multi-Link element
|
|
(MLE) with an out-of-bounds link_id could lead to memory corruption.
|
|
However, the modified location is within the body of the received frame
|
|
and as such, this does not result in additional issues since that area
|
|
is controlled by the transmitter of the frame. In any case, it is better
|
|
to be explicit with validating the Link ID value.
|
|
|
|
This commit introduces a strict bounds check immediately after link_id
|
|
extraction. If link_id exceeds or equals MAX_NUM_MLD_LINKS, parsing is
|
|
gracefully aborted with a debug log entry.
|
|
|
|
Fixes: de5e01010cb2 ("wpa_supplicant: Support ML probe request")
|
|
Signed-off-by: Amarnath Hullur Subramanyam <amarnathhs@google.com>
|
|
---
|
|
wpa_supplicant/bss.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
--- a/wpa_supplicant/bss.c
|
|
+++ b/wpa_supplicant/bss.c
|
|
@@ -2055,6 +2055,11 @@ void wpa_bss_parse_basic_ml_element(stru
|
|
goto out;
|
|
|
|
link_id = ml_basic_common_info->variable[0] & EHT_ML_LINK_ID_MSK;
|
|
+ if (link_id >= MAX_NUM_MLD_LINKS) {
|
|
+ wpa_printf(MSG_DEBUG, "MLD: Invalid link ID %u in Basic MLE",
|
|
+ link_id);
|
|
+ goto out;
|
|
+ }
|
|
|
|
os_memcpy(bss->mld_addr, ml_basic_common_info->mld_addr, ETH_ALEN);
|
|
|