From: Kalle Valo <kvalo@codeaurora.org>
To: Felix Fietkau <nbd@nbd.name>
Cc: linux-wireless@vger.kernel.org
Subject: Re: [PATCH 5.13] mt76: validate rx A-MSDU subframes
Date: Sat, 15 May 2021 11:48:14 +0000 (UTC) [thread overview]
Message-ID: <20210515114814.6599FC4338A@smtp.codeaurora.org> (raw)
In-Reply-To: <20210513070303.20253-1-nbd@nbd.name>
Felix Fietkau <nbd@nbd.name> wrote:
> Mitigate A-MSDU injection attacks (CVE-2020-24588) by detecting if the
> destination address of a subframe equals an RFC1042 (i.e., LLC/SNAP)
> header, and if so dropping the complete A-MSDU frame. This mitigates
> known attacks, although new (unknown) aggregation-based attacks may
> remain possible.
>
> This defense works because in A-MSDU aggregation injection attacks, a
> normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means
> the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042
> header. In other words, the destination MAC address of the first A-MSDU
> subframe contains the start of an RFC1042 header during an aggregation
> attack. We can detect this and thereby prevent this specific attack.
> For details, see Section 7.2 of "Fragment and Forge: Breaking Wi-Fi
> Through Frame Aggregation and Fragmentation".
>
> Signed-off-by: Felix Fietkau <nbd@nbd.name>
Patch applied to wireless-drivers.git, thanks.
2c2bdd2372af mt76: validate rx A-MSDU subframes
--
https://patchwork.kernel.org/project/linux-wireless/patch/20210513070303.20253-1-nbd@nbd.name/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
prev parent reply other threads:[~2021-05-15 11:48 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-13 7:03 [PATCH 5.13] mt76: validate rx A-MSDU subframes Felix Fietkau
2021-05-15 11:48 ` Kalle Valo [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210515114814.6599FC4338A@smtp.codeaurora.org \
--to=kvalo@codeaurora.org \
--cc=linux-wireless@vger.kernel.org \
--cc=nbd@nbd.name \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.