Patchwork [maverick/master] nl80211: fix overflow in ssid_len - CVE-2011-2517

login
register
mail settings
Submitter Paolo Pisati
Date Oct. 11, 2011, 4:01 p.m.
Message ID <1318348882-2218-4-git-send-email-paolo.pisati@canonical.com>
Download mbox | patch
Permalink /patch/119015/
State New
Headers show

Comments

Paolo Pisati - Oct. 11, 2011, 4:01 p.m.
When one of the SSID's length passed in a scan or sched_scan request
is larger than 255, there will be an overflow in the u8 that is used
to store the length before checking.  This causes the check to fail
and we overrun the buffer when copying the SSID.

Fix this by checking the nl80211 attribute length before copying it to
the struct.

This is a follow up for the previous commit
4d82dd167b85f3855c9ef5ed98e0b4bddb47f867, which didn't fix the problem
entirely.

Reported-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

CVE-2011-2517

BugLink: http://bugs.launchpad.net/bugs/869245

upstream commit 57a27e1d6a3bb9ad4efeebd3a8c71156d6207536

Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
---
 net/wireless/nl80211.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

Patch

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index da657d8..8c6a430 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3179,12 +3179,12 @@  static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 	i = 0;
 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
-			if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
+			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
 				err = -EINVAL;
 				goto out_free;
 			}
-			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
 			request->ssids[i].ssid_len = nla_len(attr);
+			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
 			i++;
 		}
 	}