Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2020-12653: git/torvalds/linux.git - Linux kernel source tree

An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea.

CVE
#linux#dos#git#rce#buffer_overflow#auth

author

Qing Xu [email protected]

2020-01-02 10:39:27 +0800

committer

Kalle Valo [email protected]

2020-01-27 16:34:34 +0200

commit

b70261a288ea4d2f4ac7cd04be08a9f0f2de4f4d (patch)

tree

4b890433ba96c95b071b24e02bbb45ae1f4974b7

parent

3a9b153c5591548612c3955c9600a98150c81875 (diff)

download

linux-b70261a288ea4d2f4ac7cd04be08a9f0f2de4f4d.tar.gz

mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()

mwifiex_cmd_append_vsie_tlv() calls memcpy() without checking the destination size may trigger a buffer overflower, which a local user could use to cause denial of service or the execution of arbitrary code. Fix it by putting the length check before calling memcpy(). Signed-off-by: Qing Xu [email protected] Signed-off-by: Kalle Valo [email protected]

-rw-r–r--

drivers/net/wireless/marvell/mwifiex/scan.c

7

1 files changed, 7 insertions, 0 deletions

diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 98f942b797f7b…a7968a84aaf88 100644
— a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c

@@ -2884,6 +2884,13 @@ mwifiex_cmd_append_vsie_tlv(struct mwifiex_private *priv,

vs_param_set->header.len =

cpu_to_le16((((u16) priv->vs_ie[id].ie[1])

& 0x00FF) + 2);

+ if (le16_to_cpu(vs_param_set->header.len) >

+ MWIFIEX_MAX_VSIE_LEN) {

+ mwifiex_dbg(priv->adapter, ERROR,

+ “Invalid param length!\n”);

+ break;

+ }

memcpy(vs_param_set->ie, priv->vs_ie[id].ie,

le16_to_cpu(vs_param_set->header.len));

*buffer += le16_to_cpu(vs_param_set->header.len) +

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907