No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Johannes Berg 020402c7dd wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans()
commit aebe9f4639b13a1f4e9a6b42cdd2e38c617b442d upstream.

In the copy code of the elements, we do the following calculation
to reach the end of the MBSSID element:

	/* copy the IEs after MBSSID */
	cpy_len = mbssid[1] + 2;

This looks fine, however, cpy_len is a u8, the same as mbssid[1],
so the addition of two can overflow. In this case the subsequent
memcpy() will overflow the allocated buffer, since it copies 256
bytes too much due to the way the allocation and memcpy() sizes
are calculated.

Fix this by using size_t for the cpy_len variable.

This fixes CVE-2022-41674.

Reported-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 0b8fb8235b ("cfg80211: Parsing of Multiple BSSID information in scanning")
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-15 07:54:40 +02:00
arch arch: um: Mark the stack non-executable to fix a binutils warning 2022-10-15 07:54:38 +02:00
block blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created 2022-08-25 11:17:36 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:11:22 +02:00
crypto crypto: drbg - make reseeding from get_random_bytes() synchronous 2022-06-22 14:11:18 +02:00
Documentation ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer 2022-10-15 07:54:37 +02:00
drivers random: use expired timer rather than wq for mixing fast pool 2022-10-15 07:54:40 +02:00
fs ceph: don't truncate file in atomic_open 2022-10-15 07:54:39 +02:00
include scsi: stex: Properly zero out the passthrough command structure 2022-10-15 07:54:39 +02:00
init random: handle latent entropy and command line from random_init() 2022-06-22 14:11:17 +02:00
ipc ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() 2022-06-14 18:11:41 +02:00
kernel workqueue: don't skip lockdep work dependency in cancel_work_sync() 2022-09-28 11:04:09 +02:00
lib lib/vdso: Mark do_hres() and do_coarse() as __always_inline 2022-09-05 10:27:47 +02:00
LICENSES
mm mm: pagewalk: Fix race between unmap and page walker 2022-10-15 07:54:36 +02:00
net wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() 2022-10-15 07:54:40 +02:00
samples
scripts Makefile.extrawarn: Move -Wcast-function-type-strict to W=1 2022-10-07 09:16:57 +02:00
security efi: Correct Macmini DMI match in uefi cert quirk 2022-10-15 07:54:39 +02:00
sound ALSA: hda: Fix position reporting on Poulsbo 2022-10-15 07:54:39 +02:00
tools perf tools: Fixup get_current_dir_name() compilation 2022-10-15 07:54:36 +02:00
usr
virt KVM: Add infrastructure and macro to mark VM as bugged 2022-08-25 11:18:16 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS MAINTAINERS: add Chandan as xfs maintainer for 5.4.y 2022-09-28 11:03:58 +02:00
Makefile Linux 5.4.217 2022-10-07 09:16:57 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.