Hauke Mehrtens
8614a2ba68
Cherry pick the patches recommended in the hostapd security advisory 2026-1: https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt Vulnerability Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE 802.11be/Wi-Fi 7) information has been identified in hostapd and wpa_supplicant. These issues show up in various cases where frames including information on affiliated links are parsed and processed in both AP and STA modes. The issues can result in process termination due to buffer read overflow checks and memory corruption. The issues for AP mode (hostapd or wpa_supplicant) can result in denial-of-service attacks due to process termination and small memory corruption that could theoretically cause other issues, but it does not seem likely that those could be exploiting in practice. Affected areas can be reached by sending invalid Management frames without needing authentication or user action on the target device. CVE-2026-58374 Link: https://github.com/openwrt/openwrt/pull/24043 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
40 lines
1.5 KiB
Diff
40 lines
1.5 KiB
Diff
From a329773522953892d9bb4548482d42fc93fea329 Mon Sep 17 00:00:00 2001
|
|
From: David Bauer <mail@david-bauer.net>
|
|
Date: Thu, 27 Jun 2024 18:45:19 +0200
|
|
Subject: [PATCH] AP: don't ignore probe-requests with invalid DSSS params
|
|
|
|
Don't ignore probe requests which contain an invalid DS parameter for the
|
|
current operating channel.
|
|
|
|
As the comment outlines, the drop shall only apply if
|
|
dot11RadioMeasurementActivated is set to 1.
|
|
|
|
However, it was observed Linux clients (Debian 12 / NixOS 23.11)
|
|
with an Intel 8265 NIC may generate a probe request frame with
|
|
dot11RadioMeasurementActivated set to false and an invalid DSSS
|
|
parameter.
|
|
|
|
These were also dropped even though they should not have been. They
|
|
however should not have contained this parameter in the first place.
|
|
|
|
Don't drop Probe Requests which contain such an invalid field. This may
|
|
lead to more probe responses being sent, however it does fix very
|
|
frequent connection issues for these clients on 2.4 GHz.
|
|
|
|
Signed-off-by: David Bauer <mail@david-bauer.net>
|
|
---
|
|
src/ap/beacon.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
--- a/src/ap/beacon.c
|
|
+++ b/src/ap/beacon.c
|
|
@@ -1526,7 +1526,7 @@ void handle_probe_req(struct hostapd_dat
|
|
* is less likely to see them (Probe Request frame sent on a
|
|
* neighboring, but partially overlapping, channel).
|
|
*/
|
|
- if (elems.ds_params &&
|
|
+ if (elems.ds_params && 0 &&
|
|
hapd->iface->current_mode &&
|
|
(hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G ||
|
|
hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211B) &&
|