Hauke Mehrtens
8614a2ba68
Cherry pick the patches recommended in the hostapd security advisory 2026-1: https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt Vulnerability Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE 802.11be/Wi-Fi 7) information has been identified in hostapd and wpa_supplicant. These issues show up in various cases where frames including information on affiliated links are parsed and processed in both AP and STA modes. The issues can result in process termination due to buffer read overflow checks and memory corruption. The issues for AP mode (hostapd or wpa_supplicant) can result in denial-of-service attacks due to process termination and small memory corruption that could theoretically cause other issues, but it does not seem likely that those could be exploiting in practice. Affected areas can be reached by sending invalid Management frames without needing authentication or user action on the target device. CVE-2026-58374 Link: https://github.com/openwrt/openwrt/pull/24043 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
50 lines
1.6 KiB
Diff
50 lines
1.6 KiB
Diff
From e4bd3442c2223802bf8c4a4d868e3b9443c7caf4 Mon Sep 17 00:00:00 2001
|
|
From: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
|
|
Date: Mon, 18 May 2026 12:13:21 +0300
|
|
Subject: MLD: Verify link ID validity in MLE in reconfiguration cases
|
|
|
|
Ignore or reject invalid link ID value 15 in ML reconfiguration.
|
|
|
|
Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
|
|
---
|
|
src/ap/ieee802_11_eht.c | 2 ++
|
|
wpa_supplicant/bss.c | 3 ++-
|
|
wpa_supplicant/wnm_sta.c | 3 ++-
|
|
3 files changed, 6 insertions(+), 2 deletions(-)
|
|
|
|
--- a/src/ap/ieee802_11_eht.c
|
|
+++ b/src/ap/ieee802_11_eht.c
|
|
@@ -2166,6 +2166,8 @@ hostapd_parse_link_reconf_req_sta_profil
|
|
|
|
link_id = sta_control & EHT_PER_STA_RECONF_CTRL_LINK_ID_MSK;
|
|
wpa_printf(MSG_DEBUG, "MLD: Per-STA profile for link=%u", link_id);
|
|
+ if (link_id >= MAX_NUM_MLD_LINKS)
|
|
+ goto out;
|
|
|
|
reconf_type_mask =
|
|
sta_control & EHT_PER_STA_RECONF_CTRL_OP_UPDATE_TYPE_MSK;
|
|
--- a/wpa_supplicant/bss.c
|
|
+++ b/wpa_supplicant/bss.c
|
|
@@ -2243,7 +2243,8 @@ u16 wpa_bss_parse_reconf_ml_element(stru
|
|
u8 link_id;
|
|
|
|
link_id = control & EHT_PER_STA_RECONF_CTRL_LINK_ID_MSK;
|
|
- removed_links |= BIT(link_id);
|
|
+ if (link_id < MAX_NUM_MLD_LINKS)
|
|
+ removed_links |= BIT(link_id);
|
|
}
|
|
|
|
pos += 2 + sub_elem_len;
|
|
--- a/wpa_supplicant/wnm_sta.c
|
|
+++ b/wpa_supplicant/wnm_sta.c
|
|
@@ -546,7 +546,8 @@ static void wnm_parse_neighbor_report_mu
|
|
control = le_to_host16(sta_prof->sta_control);
|
|
|
|
link_id = control & EHT_PER_STA_RECONF_CTRL_LINK_ID_MSK;
|
|
- rep->mld_links |= BIT(link_id);
|
|
+ if (link_id < MAX_NUM_MLD_LINKS)
|
|
+ rep->mld_links |= BIT(link_id);
|
|
}
|
|
|
|
pos += 2 + sub_elem_len;
|