wifi: mac80211: fix MBSSID parsing use-after-free

Commit 30b9d21add3e87c164f0dd6558eec90aed012f56 upstream.
This is a different version of the commit, changed to store
the non-transmitted profile in the elems, and freeing it in
the few places where it's relevant, since that is only the
case when the last argument for parsing (the non-tx BSSID)
is non-NULL.

When we parse a multi-BSSID element, we might point some
element pointers into the allocated nontransmitted_profile.
However, we free this before returning, causing UAF when the
relevant pointers in the parsed elements are accessed.

Fix this by not allocating the scratch buffer separately but
as part of the returned structure instead, that way, there
are no lifetime issues with it.

The scratch buffer introduction as part of the returned data
here is taken from MLO feature work done by Ilan.

This fixes CVE-2022-42719.

Fixes: 1cdc5b1f9f77 ("mac80211: support profile split between elements")
Co-developed-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 3d5da7a97be4156d09f5e8ce85c6b373c57a893a..f30a205323de53c2cfb1a02798ef627edbd9ba78 100644 (file)
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1519,6 +1519,8 @@ struct ieee802_11_elems {
        u8 country_elem_len;
        u8 bssid_index_len;
 
+       void *nontx_profile;
+
        /* whether a parse error occurred while retrieving these elements */
        bool parse_error;
 };

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 7d116aa4ea1fcab6c4424ea920caa16640e37013..b48a09043663a3599322117af46ff346f8333b63 100644 (file)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3299,6 +3299,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
                        sdata_info(sdata,
                                   "AP bug: VHT operation missing from AssocResp\n");
                }
+               kfree(bss_elems.nontx_profile);
        }
 
        /*
@@ -3883,6 +3884,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                ifmgd->assoc_data->timeout = jiffies;
                ifmgd->assoc_data->timeout_started = true;
                run_again(sdata, ifmgd->assoc_data->timeout);
+               kfree(elems.nontx_profile);
                return;
        }
 
@@ -4050,7 +4052,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                ieee80211_report_disconnect(sdata, deauth_buf,
                                            sizeof(deauth_buf), true,
                                            WLAN_REASON_DEAUTH_LEAVING);
-               return;
+               goto free;
        }
 
        if (sta && elems.opmode_notif)
@@ -4065,6 +4067,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                               elems.cisco_dtpc_elem);
 
        ieee80211_bss_info_change_notify(sdata, changed);
+free:
+       kfree(elems.nontx_profile);
 }
 
 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index c353162e81aea65973e2f17a866750d56843d5a3..ee65f1f50a0ab8260683846eb6a19a587fe13c19 100644 (file)
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -216,6 +216,8 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                                                rx_status, beacon);
        }
 
+       kfree(elems.nontx_profile);
+
        return bss;
 }
 

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 1ba37f67a2a080de05e410f95dfe320532215941..6223af1c3457ac01f0e85c48fd3f4dc46e300920 100644 (file)
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1363,6 +1363,11 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
                        cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
                                               nontransmitted_profile,
                                               nontransmitted_profile_len);
+               if (!nontransmitted_profile_len) {
+                       nontransmitted_profile_len = 0;
+                       kfree(nontransmitted_profile);
+                       nontransmitted_profile = NULL;
+               }
        }
 
        crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
@@ -1392,7 +1397,7 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
            offsetofend(struct ieee80211_bssid_index, dtim_count))
                elems->dtim_count = elems->bssid_index->dtim_count;
 
-       kfree(nontransmitted_profile);
+       elems->nontx_profile = nontransmitted_profile;
 
        return crc;
 }