| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-47388: mac80211: fix use-after-free in CCMP/GCMP RX |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| mac80211: fix use-after-free in CCMP/GCMP RX |
| |
| When PN checking is done in mac80211, for fragmentation we need |
| to copy the PN to the RX struct so we can later use it to do a |
| comparison, since commit bf30ca922a0c ("mac80211: check defrag |
| PN against current frame"). |
| |
| Unfortunately, in that commit I used the 'hdr' variable without |
| it being necessarily valid, so use-after-free could occur if it |
| was necessary to reallocate (parts of) the frame. |
| |
| Fix this by reloading the variable after the code that results |
| in the reallocations, if any. |
| |
| This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401. |
| |
| The Linux kernel CVE team has assigned CVE-2021-47388 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.4.271 with commit 608b0a2ae928a74a2f89e02227339dd79cdb63cf and fixed in 4.4.286 with commit 447d001b875d0e7f211c4ba004916028da994258 |
| Issue introduced in 4.9.271 with commit d0f613fe6de344dc17ba04a88921a2094c13d3fa and fixed in 4.9.285 with commit 31de381aef0ab1b342f62485118dc8a19363dc78 |
| Issue introduced in 4.14.235 with commit a9b57952fed41556c950a92123086724eaf11919 and fixed in 4.14.249 with commit f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb |
| Issue introduced in 4.19.193 with commit 0f716b48ed25503e6961f4b5b40ece36f7e4ed26 and fixed in 4.19.209 with commit 3d5d629c99c468458022e9b381789de3595bf4dd |
| Issue introduced in 5.4.124 with commit c8b3a6150dc8ac78d5fdd5fbdfc4806249ef8b2c and fixed in 5.4.151 with commit 50149e0866a82cef33e680ee68dc380a5bc75d32 |
| Issue introduced in 5.10.42 with commit e64ea0597050157f926ac2ba9b478a44ee5be945 and fixed in 5.10.71 with commit 57de2dcb18742dc2860861c9f496da7d42b67da0 |
| Issue introduced in 5.13 with commit bf30ca922a0c0176007e074b0acc77ed345e9990 and fixed in 5.14.10 with commit 27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9 |
| Issue introduced in 5.13 with commit bf30ca922a0c0176007e074b0acc77ed345e9990 and fixed in 5.15 with commit 94513069eb549737bcfc3d988d6ed4da948a2de8 |
| Issue introduced in 5.12.9 with commit 1f0bf30c01d3f4de7d6c5e27b102a808c5646676 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-47388 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/mac80211/wpa.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/447d001b875d0e7f211c4ba004916028da994258 |
| https://git.kernel.org/stable/c/31de381aef0ab1b342f62485118dc8a19363dc78 |
| https://git.kernel.org/stable/c/f556e1d6fb9f2923a9a36f3df638c7d79ba09dbb |
| https://git.kernel.org/stable/c/3d5d629c99c468458022e9b381789de3595bf4dd |
| https://git.kernel.org/stable/c/50149e0866a82cef33e680ee68dc380a5bc75d32 |
| https://git.kernel.org/stable/c/57de2dcb18742dc2860861c9f496da7d42b67da0 |
| https://git.kernel.org/stable/c/27d3eb5616ee2c0a3b30c3fa34813368ed1f3dc9 |
| https://git.kernel.org/stable/c/94513069eb549737bcfc3d988d6ed4da948a2de8 |
