* [PATCH] wifi: mwifiex: Security: Fix memcpy oobs in mwifiex_set_encode
@ 2023-07-06 2:07 pinkperfect
2023-07-08 6:48 ` [PATCH] wifi: mwifiex: " pinkperfect
0 siblings, 1 reply; 2+ messages in thread
From: pinkperfect @ 2023-07-06 2:07 UTC (permalink / raw)
To: amitkarwar, kvalo, ganapathi017, sharvari.harisangam, huxinming820
Cc: linux-wireless, linux-kernel, pinkperfect
In cfg80211 flow, when handling userspace netlink messages
if input cipher mode is WLAN_CIPHER_SUITE_SMS4
will make cfg80211_validate_key_settings not check key_len and seq_len
which will cause controllable memcpy overwrite
So needs to check them in mwifiex_set_encode.
Signed-off-by: pinkperfect <pinkperfect2021@gmail.com>
---
drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
index a2ad2b53f016..bddc11eac8a9 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
@@ -1099,6 +1099,11 @@ int mwifiex_set_encode(struct mwifiex_private *priv, struct key_params *kp,
{
struct mwifiex_ds_encrypt_key encrypt_key;
+ if (key_len > WLAN_MAX_KEY_LEN || (kp && kp->seq_len > PN_LEN)) {
+ mwifiex_dbg(priv->adapter, ERROR, "invalid parameters");
+ return -1;
+ }
+
memset(&encrypt_key, 0, sizeof(encrypt_key));
encrypt_key.key_len = key_len;
encrypt_key.key_index = key_index;
--
2.25.1
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-07-08 6:49 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-06 2:07 [PATCH] wifi: mwifiex: Security: Fix memcpy oobs in mwifiex_set_encode pinkperfect
2023-07-08 6:48 ` [PATCH] wifi: mwifiex: " pinkperfect
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®