Hauke Mehrtens
8614a2ba68
Cherry pick the patches recommended in the hostapd security advisory 2026-1: https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt Vulnerability Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE 802.11be/Wi-Fi 7) information has been identified in hostapd and wpa_supplicant. These issues show up in various cases where frames including information on affiliated links are parsed and processed in both AP and STA modes. The issues can result in process termination due to buffer read overflow checks and memory corruption. The issues for AP mode (hostapd or wpa_supplicant) can result in denial-of-service attacks due to process termination and small memory corruption that could theoretically cause other issues, but it does not seem likely that those could be exploiting in practice. Affected areas can be reached by sending invalid Management frames without needing authentication or user action on the target device. CVE-2026-58374 Link: https://github.com/openwrt/openwrt/pull/24043 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
56 lines
1.9 KiB
Diff
56 lines
1.9 KiB
Diff
From 595194d0305189922a057e8ea8b743a1bd8d2d29 Mon Sep 17 00:00:00 2001
|
|
From: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
|
|
Date: Mon, 18 May 2026 16:17:15 +0300
|
|
Subject: BSS: Fix validation of ML common info length during scan result
|
|
parsing
|
|
|
|
The validation of the ML common info length before use allowed reading
|
|
beyond the end of the element when the MSD info and EML capabilities
|
|
were claimed to be present but were not actually inclued. While this was
|
|
noticed after reading these fields and further processing of the element
|
|
was stopped, this could result in reading two bytes beyond the end of
|
|
the buffer.
|
|
|
|
Avoid this by checking the remaining length explicitly for the optiional
|
|
fields.
|
|
|
|
Fixes: 1b07e8baca13 ("BSS: Use correct AP MLD ID")
|
|
Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
|
|
---
|
|
wpa_supplicant/bss.c | 11 ++++++++++-
|
|
1 file changed, 10 insertions(+), 1 deletion(-)
|
|
|
|
--- a/wpa_supplicant/bss.c
|
|
+++ b/wpa_supplicant/bss.c
|
|
@@ -2006,13 +2006,20 @@ void wpa_bss_parse_basic_ml_element(stru
|
|
|
|
/* Medium Synchronization Delay Information */
|
|
if (le_to_host16(eht_ml->ml_control) &
|
|
- BASIC_MULTI_LINK_CTRL_PRES_MSD_INFO)
|
|
+ BASIC_MULTI_LINK_CTRL_PRES_MSD_INFO) {
|
|
+ if (ml_basic_common_info->len <
|
|
+ sizeof(*ml_basic_common_info) + pos + 2)
|
|
+ goto out;
|
|
pos += 2;
|
|
+ }
|
|
|
|
/* EML Capabilities */
|
|
bss->eml_capa = 0;
|
|
if (le_to_host16(eht_ml->ml_control) &
|
|
BASIC_MULTI_LINK_CTRL_PRES_EML_CAPA) {
|
|
+ if (ml_basic_common_info->len <
|
|
+ sizeof(*ml_basic_common_info) + pos + 2)
|
|
+ goto out;
|
|
bss->eml_capa =
|
|
WPA_GET_LE16(&ml_basic_common_info->variable[pos]);
|
|
pos += 2;
|
|
@@ -2020,6 +2027,8 @@ void wpa_bss_parse_basic_ml_element(stru
|
|
|
|
/* MLD Capabilities And Operations (always present, see
|
|
* control/control_mask) */
|
|
+ if (ml_basic_common_info->len < sizeof(*ml_basic_common_info) + pos + 2)
|
|
+ goto out;
|
|
bss->mld_capa = WPA_GET_LE16(&ml_basic_common_info->variable[pos]);
|
|
pos += 2;
|
|
|