Hauke Mehrtens
8614a2ba68
Cherry pick the patches recommended in the hostapd security advisory 2026-1: https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt Vulnerability Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE 802.11be/Wi-Fi 7) information has been identified in hostapd and wpa_supplicant. These issues show up in various cases where frames including information on affiliated links are parsed and processed in both AP and STA modes. The issues can result in process termination due to buffer read overflow checks and memory corruption. The issues for AP mode (hostapd or wpa_supplicant) can result in denial-of-service attacks due to process termination and small memory corruption that could theoretically cause other issues, but it does not seem likely that those could be exploiting in practice. Affected areas can be reached by sending invalid Management frames without needing authentication or user action on the target device. CVE-2026-58374 Link: https://github.com/openwrt/openwrt/pull/24043 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
38 lines
1.3 KiB
Diff
38 lines
1.3 KiB
Diff
From ce1a8612e309fe86133ecf05ffb452b0bdf3b035 Mon Sep 17 00:00:00 2001
|
|
From: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
|
|
Date: Mon, 18 May 2026 15:45:15 +0300
|
|
Subject: AP MLD: Verify AP MLD link ID validity before updating bitmap of
|
|
links
|
|
|
|
Link ID is 0..14, so ignore value 15 if an invalid frame is processed.
|
|
It does not look like the invalid value was actually used to reference
|
|
any local array, but in any case, it is better to not mark an invalid
|
|
link as being specified.
|
|
|
|
Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
|
|
---
|
|
src/ap/beacon.c | 5 ++++-
|
|
1 file changed, 4 insertions(+), 1 deletion(-)
|
|
|
|
--- a/src/ap/beacon.c
|
|
+++ b/src/ap/beacon.c
|
|
@@ -1411,6 +1411,7 @@ static bool parse_ml_probe_req(const str
|
|
for_each_element_id(sub, 0, pos, len) {
|
|
const struct ieee80211_eht_per_sta_profile *sta;
|
|
u16 sta_control;
|
|
+ u8 link_id;
|
|
|
|
if (*links == 0xffff)
|
|
*links = 0;
|
|
@@ -1430,7 +1431,9 @@ static bool parse_ml_probe_req(const str
|
|
* partial profile was requested.
|
|
*/
|
|
sta_control = le_to_host16(sta->sta_control);
|
|
- *links |= BIT(sta_control & BASIC_MLE_STA_CTRL_LINK_ID_MASK);
|
|
+ link_id = sta_control & BASIC_MLE_STA_CTRL_LINK_ID_MASK;
|
|
+ if (link_id < MAX_NUM_MLD_LINKS)
|
|
+ *links |= BIT(link_id);
|
|
}
|
|
|
|
if (!for_each_element_completed(sub, pos, len)) {
|