Changeset 2749

Show
Ignore:
Timestamp:
10/16/07 10:58:14 (1 year ago)
Author:
kelmo
Message:

Fix CVE-2007-5448:

| Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial
| of service (panic) via a beacon frame with a large length value in the
| extended supported rates (xrates) element, which triggers an assertion
| error, related to net80211/ieee80211_scan_ap.c and
| net80211/ieee80211_scan_sta.c.

One interesting fact is that net80211/ieee80211_scan_ap.c is not prone to
this vulnerability in any of our releases. r2724 is the first revision
where net80211/ieee80211_scan_ap.c is vulnerable.

Reference changeset: r2724

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • madwifi/releases/0.9.3/net80211/_ieee80211.h

    r2614 r2749  
    226226#define IEEE80211_RATE_SIZE     8               /* 802.11 standard */ 
    227227#define IEEE80211_RATE_MAXSIZE  15              /* max rates we'll handle */ 
     228#define IEEE80211_SANITISE_RATESIZE(_rsz) \ 
     229        ((_rsz > IEEE80211_RATE_MAXSIZE) ? IEEE80211_RATE_MAXSIZE : _rsz) 
    228230 
    229231struct ieee80211_rateset { 

  • madwifi/releases/0.9.3/net80211/ieee80211_scan_sta.c

    r2606 r2749  
    236236            (ISPROBE(subtype) || ise->se_ssid[1] == 0)) 
    237237                memcpy(ise->se_ssid, sp->ssid, 2 + sp->ssid[1]); 
    238         KASSERT(sp->rates[1] <= IEEE80211_RATE_MAXSIZE, 
    239                 ("rate set too large: %u", sp->rates[1])); 
    240         memcpy(ise->se_rates, sp->rates, 2 + sp->rates[1]); 
     238        memcpy(ise->se_rates, sp->rates,  
     239                        2 + IEEE80211_SANITISE_RATESIZE(sp->rates[1])); 
    241240        if (sp->xrates != NULL) { 
    242                 /* XXX validate xrates[1] */ 
    243                 KASSERT(sp->xrates[1] <= IEEE80211_RATE_MAXSIZE, 
    244                         ("xrate set too large: %u", sp->xrates[1])); 
    245                 memcpy(ise->se_xrates, sp->xrates, 2 + sp->xrates[1]); 
     241                memcpy(ise->se_xrates, sp->xrates,  
     242                                2 + IEEE80211_SANITISE_RATESIZE(sp->xrates[1])); 
    246243        } else 
    247244                ise->se_xrates[1] = 0;