Hauke Mehrtens
8614a2ba68
Cherry pick the patches recommended in the hostapd security advisory 2026-1: https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt Vulnerability Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE 802.11be/Wi-Fi 7) information has been identified in hostapd and wpa_supplicant. These issues show up in various cases where frames including information on affiliated links are parsed and processed in both AP and STA modes. The issues can result in process termination due to buffer read overflow checks and memory corruption. The issues for AP mode (hostapd or wpa_supplicant) can result in denial-of-service attacks due to process termination and small memory corruption that could theoretically cause other issues, but it does not seem likely that those could be exploiting in practice. Affected areas can be reached by sending invalid Management frames without needing authentication or user action on the target device. CVE-2026-58374 Link: https://github.com/openwrt/openwrt/pull/24043 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
46 lines
1.7 KiB
Diff
46 lines
1.7 KiB
Diff
From a8531e3d871e6fa72f2f85d91e9f787326b2af8b Mon Sep 17 00:00:00 2001
|
|
From: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
|
|
Date: Tue, 31 Mar 2026 23:16:08 +0300
|
|
Subject: MLD: Validate MLE Link ID fields in association rejection case
|
|
|
|
The Link ID Info field in the Common Info field needs to ignore the
|
|
reserved bits to be more extensible for future. Both that link ID for
|
|
the association link and the link IDs for other links need to be
|
|
verified to be within the valid range (0-14), so check that here. The
|
|
parsed link ID was not used for anything yet, but it is better to make
|
|
sure this in theory common parser is not exposing invalid data to the
|
|
caller should it be used for additional purposes in the future.
|
|
|
|
Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
|
|
---
|
|
wpa_supplicant/events.c | 11 ++++++++++-
|
|
1 file changed, 10 insertions(+), 1 deletion(-)
|
|
|
|
--- a/wpa_supplicant/events.c
|
|
+++ b/wpa_supplicant/events.c
|
|
@@ -4318,7 +4318,12 @@ static unsigned int wpas_ml_parse_assoc(
|
|
pos = common_info->variable;
|
|
|
|
/* Store the information for the association link */
|
|
- ml_info[i].link_id = *pos;
|
|
+ ml_info[i].link_id = *pos & EHT_ML_LINK_ID_MSK;
|
|
+ if (ml_info[i].link_id >= MAX_NUM_MLD_LINKS) {
|
|
+ wpa_printf(MSG_DEBUG,
|
|
+ "MLD: Invalid Link ID value for assoc link");
|
|
+ goto out;
|
|
+ }
|
|
pos++;
|
|
|
|
/* Skip the BSS Parameters Change Count */
|
|
@@ -4474,6 +4479,10 @@ static unsigned int wpas_ml_parse_assoc(
|
|
MAC2STR(pos + 1), nstr_bitmap_len);
|
|
|
|
ml_info[i].link_id = ctrl & BASIC_MLE_STA_CTRL_LINK_ID_MASK;
|
|
+ if (ml_info[i].link_id >= MAX_NUM_MLD_LINKS) {
|
|
+ wpa_printf(MSG_DEBUG, "MLD: Invalid Link ID value");
|
|
+ goto out;
|
|
+ }
|
|
os_memcpy(ml_info[i].bssid, pos + 1, ETH_ALEN);
|
|
|
|
pos += sta_info_len;
|