From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2FAEE135A79 for ; Sun, 15 Sep 2024 22:45:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1726440310; cv=none; b=MvemeK2YYj2jx9JRwWtY9/If3DC1DEYrCo47brN09eJzwnd+Eom8/heTCY0K5YLblPj/XItVLZ24e6k1u02izSP8gdaQBvizw8KBSqn6c3MnegnV7bfcJ+zUA+1uL8Mo5JiRb2Gb+qcgVS9lGZ5tCHtPCUMh/KselvtbF8hebOs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1726440310; c=relaxed/simple; bh=sRHSmC4I4lxe/Csx9+kfEzFHuEfbKT0NRn/AM4yYXR4=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=LCOcH4UabxV3mgurFKZtSU0G7N5MbMFlLBcKTw+jQinTUpYEdQWfnmfSYRDzZUaQhh4YSJ0fuYeNPqhBNlOpbEqVrooxPqQevBGEpB7LG1DpTqODpiIlzvGTtjIWhEHKRzGoybKV0aU++hN+3H5jvUtxDILTh3umiOrtON9qq6o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QMeeIeMz; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="QMeeIeMz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D166C4CEC3; Sun, 15 Sep 2024 22:45:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1726440309; bh=sRHSmC4I4lxe/Csx9+kfEzFHuEfbKT0NRn/AM4yYXR4=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=QMeeIeMzuoHqt8DHc0oniNF3wZpMPOf8oDmLm82J0LTLitjO2I2ar6qksfwO6+uwG TJGyK4ftv79W7iRVINEoiMJgTCE2/RJy6AjDtcg7fb5l8oKw+mvxoBesMBeelDkZal AKd99bYMMDfiBfviviIk0KBDvcedhcu0s+gNcq+Y= Date: Mon, 16 Sep 2024 00:45:05 +0200 From: Greg KH To: Sherlock Fang Cc: "security@kernel.org" , "linux-wireless@vger.kernel.org" Subject: Re: {Disarmed} Two potential 1-byte BOF in cfg80211.c of driver MWIFIEX Message-ID: <2024091654-flagship-untried-1c23@gregkh> References: Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: On Sun, Sep 15, 2024 at 06:12:21PM +0000, Sherlock Fang wrote: > Dear Security Team, > > > I have used static code analysis tools to scan the Linux Kernel of the latest build, and with collaborative help from Prof. Yueqi Chen, we have been able to manually confirm the presence of two 1-byte BOF in drivers/net/wireless/marvell/mwifiex/cfg80211.c > > At both line https://github.com/torvalds/linux/blob/master/drivers/net/wireless/marvell/mwifiex/cfg80211.c#L2679 and https://github.com/torvalds/linux/blob/master/drivers/net/wireless/marvell/mwifiex/cfg80211.c#L2777, the calls to > > memcpy(&priv->vs_ie[i].ie, ie, sizeof(*ie) + ie->len); > > are theoretically possible to cause a buffer overflow since the destination buffer is an array of bytes with a size defined by MWIFIEX_MAX_VSIE_LEN of 256 bytes, which is the maximum amount of data that can safely be stored in priv->vs_ie[i].ie. The size parameter "sizeof(*ie) + ie->len" theoretically has the maximum value of "2 + 255 = 257" given that len is of type u8 which has upper limit of 255, and sizeof(*ie) is equivalent to sizeof(struct ieee_types_header), that is just the size of two u8 field (two bytes). > > Our suggested fix would be to add a check before calling memcpy: > > If (sizeof(*ie) + ie->len > sizeof(&priv->vs_ie[i].ie)) { >       continue; > } > > memcpy(&priv->vs_ie[i].ie, ie, sizeof(*ie) + ie->len); Great, can you submit a real patch for this so that it can be reviewed and accepted if ok? Also, you are sure that the data being copied could really be that big, right? Where does it come from? thanks, greg k-h