Wen Gong
cbc470aa3f
mac80211: extend protection against mixed key and fragment cache attacks ...
commit 3edc6b0d6c061a70d8ca3c3c72eb1f58ce29bfb1 upstream.
For some chips/drivers, e.g., QCA6174 with ath10k, the decryption is
done by the hardware, and the Protected bit in the Frame Control field
is cleared in the lower level driver before the frame is passed to
mac80211. In such cases, the condition for ieee80211_has_protected() is
not met in ieee80211_rx_h_defragment() of mac80211 and the new security
validation steps are not executed.
Extend mac80211 to cover the case where the Protected bit has been
cleared, but the frame is indicated as having been decrypted by the
hardware. This extends protection against mixed key and fragment cache
attack for additional drivers/chips. This fixes CVE-2020-24586 and
CVE-2020-24587 for such cases.
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1
Cc: stable@vger.kernel.org
Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20210511200110.037aa5ca0390.I7bb888e2965a0db02a67075fcb5deb50eb7408aa@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-03 08:59:02 +02:00
net: vlan: avoid leaks on register_vlan_dev() failures
2021-01-17 14:05:31 +01:00
appletalk: Fix skb allocation size in loopback case
2021-04-07 14:47:41 +02:00
batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field
2021-04-14 08:24:11 +02:00
Bluetooth: SMP: Fail if remote and local public keys are identical
2021-05-26 12:05:21 +02:00
bridge: Fix possible races between assigning rx_handler_data and setting IFF_BRIDGE_PORT bit
2021-05-22 11:38:29 +02:00
can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE
2021-04-14 08:24:14 +02:00
libceph: clear con->out_msg on Policy::stateful_server faults
2020-11-05 11:43:34 +01:00
mm: fix struct page layout on 32-bit systems
2021-05-19 10:08:31 +02:00
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
2021-01-23 15:57:59 +01:00
ipv6: weaken the v4mapped source check
2021-04-07 14:47:38 +02:00
net: dsa: tag_mtk: fix 802.1ad VLAN egress
2021-03-20 10:39:47 +01:00
hsr: use netdev_err() instead of WARN_ONCE()
2021-05-14 09:44:10 +02:00
net: ieee802154: forbid monitor for add llsec seclevel
2021-04-21 12:56:15 +02:00
net: Only allow init netns to set default tcp cong to a restricted algo
2021-05-14 09:44:33 +02:00
ipv6: remove extra dev_hold() for fallback tunnels
2021-05-22 11:38:30 +02:00
net/af_iucv: remove WARN_ONCE on malformed RX packets
2021-03-07 12:20:42 +01:00
af_key: relax availability checks for skb size calculation
2021-02-13 13:52:54 +01:00
net: lapb: Copy the skb before sending a packet
2021-02-10 09:25:28 +01:00
mac80211: extend protection against mixed key and fragment cache attacks
2021-06-03 08:59:02 +02:00
net: mac802154: Fix general protection fault
2021-04-14 08:24:18 +02:00
net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0
2021-03-17 17:03:31 +01:00
net/ncsi: Avoid channel_monitor hrtimer deadlock
2021-04-14 08:24:15 +02:00
netfilter: conntrack: Make global sysctls readonly in non-init netns
2021-05-19 10:08:33 +02:00
cipso,calipso: resolve a number of problems with the DOI refcounts
2021-03-17 17:03:35 +01:00
NFC: nci: fix memory leak in nci_allocate_device
2021-05-28 13:10:27 +02:00
openvswitch: fix stack OOB read while fragmenting IPv4 packets
2021-05-11 14:04:14 +02:00
net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
2021-03-30 14:35:29 +02:00
net/rds: Fix a use after free in rds_message_map_pages
2021-04-14 08:24:15 +02:00
rfkill: Fix use-after-free in rfkill_resume()
2020-11-24 13:29:05 +01:00
rose: Fix Null pointer dereference in rose_send_frame()
2020-12-08 10:40:23 +01:00
rxrpc: Fix clearance of Tx/Rx ring when releasing a call
2021-02-17 10:35:18 +01:00
net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule
2021-05-19 10:08:23 +02:00
sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b
2021-05-19 10:08:27 +02:00
smc: disallow TCP_ULP in smc_setsockopt()
2021-05-19 10:08:28 +02:00
sunrpc: Fix misplaced barrier in call_decode
2021-05-19 10:08:27 +02:00
net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP
2021-02-07 15:35:46 +01:00
tipc: convert dest node's address to network order
2021-05-19 10:08:20 +02:00
net/tls: Protect from calling tls_dev_del for TLS RX twice
2020-12-08 10:40:23 +01:00
vsock/vmci: log once the failed queue pair allocation
2021-05-14 09:44:30 +02:00
cfg80211: mitigate A-MSDU aggregation attacks
2021-06-03 08:59:01 +02:00
net/x25: prevent a couple of overflows
2020-12-08 10:40:26 +01:00
xsk: Simplify detection of empty and full rings
2021-05-22 11:38:27 +02:00
net: xfrm: Localize sequence counter per network namespace
2021-04-14 08:24:13 +02:00
cbc470aa3f