Headline
CVE-2020-12653: git/torvalds/linux.git - Linux kernel source tree
An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea.
author
Qing Xu [email protected]
2020-01-02 10:39:27 +0800
committer
Kalle Valo [email protected]
2020-01-27 16:34:34 +0200
commit
b70261a288ea4d2f4ac7cd04be08a9f0f2de4f4d (patch)
tree
4b890433ba96c95b071b24e02bbb45ae1f4974b7
parent
3a9b153c5591548612c3955c9600a98150c81875 (diff)
download
linux-b70261a288ea4d2f4ac7cd04be08a9f0f2de4f4d.tar.gz
mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
mwifiex_cmd_append_vsie_tlv() calls memcpy() without checking the destination size may trigger a buffer overflower, which a local user could use to cause denial of service or the execution of arbitrary code. Fix it by putting the length check before calling memcpy(). Signed-off-by: Qing Xu [email protected] Signed-off-by: Kalle Valo [email protected]
-rw-r–r--
drivers/net/wireless/marvell/mwifiex/scan.c
7
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 98f942b797f7b…a7968a84aaf88 100644
— a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -2884,6 +2884,13 @@ mwifiex_cmd_append_vsie_tlv(struct mwifiex_private *priv,
vs_param_set->header.len =
cpu_to_le16((((u16) priv->vs_ie[id].ie[1])
& 0x00FF) + 2);
+ if (le16_to_cpu(vs_param_set->header.len) >
+ MWIFIEX_MAX_VSIE_LEN) {
+ mwifiex_dbg(priv->adapter, ERROR,
+ “Invalid param length!\n”);
+ break;
+ }
memcpy(vs_param_set->ie, priv->vs_ie[id].ie,
le16_to_cpu(vs_param_set->header.len));
*buffer += le16_to_cpu(vs_param_set->header.len) +