Описание
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: set up the TX info early to fix failure paths
The previous commit 2c51457d930f ("wifi: mac80211: free ack status
frame on TX header build failure") cleaned up the leak, but still
left the code a bit messy and the failed SKB didn't get reported
to userspace.
Fix this up by initialising skb->cb[] earlier, which allows using
ieee80211_free_txskb() and therefore reports it for the failure
in ieee80211_build_hdr(), and unifies the ieee80211_skb_resize()
failure path with it.
A flaw was found in the Linux kernel's mac80211 wireless subsystem. Transmission control information within packet buffers was not initialized early enough, preventing proper cleanup and error reporting if header construction or buffer resizing fails. A local user could exploit this flaw during network packet transmission to cause improper resource release, potentially leading to a Denial of Service (DoS).
Отчет
A low impact flaw was found in the Linux kernel's mac80211 wireless subsystem as shipped in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform (via the RHEL CoreOS kernel). Transmission control information in socket buffers (skb->cb) was initialized too late, so when frame header construction (ieee80211_build_hdr) or socket-buffer resizing (ieee80211_skb_resize) fails, the failed SKB is not released through the proper cleanup path and the failure is not reported to userspace. A local user able to transmit network traffic through the wireless stack could trigger these error paths to cause improper resource release, leading to a limited denial of service. The flaw is not remotely triggerable by ordinary received Wi-Fi traffic and involves no memory corruption, privilege escalation, or confidentiality or integrity impact. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact as Low because exploitation requires local access and depends on reaching uncommon error paths such as allocation failures, limiting the practical availability impact. Fixes for the affected product streams are currently deferred; given the local attack vector, the low likelihood of triggering the affected failure paths, and the limited availability impact, the residual risk of deferring is low.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f ("wifi: mac80211: free ack status frame on TX header build failure") cleaned up the leak, but still left the code a bit messy and the failed SKB didn't get reported to userspace. Fix this up by initialising skb->cb[] earlier, which allows using ieee80211_free_txskb() and therefore reports it for the failure in ieee80211_build_hdr(), and unifies the ieee80211_skb_resize() failure path with it.
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f ("wifi: mac80211: free ack status frame on TX header build failure") cleaned up the leak, but still left the code a bit messy and the failed SKB didn't get reported to userspace. Fix this up by initialising skb->cb[] earlier, which allows using ieee80211_free_txskb() and therefore reports it for the failure in ieee80211_build_hdr(), and unifies the ieee80211_skb_resize() failure path with it.
wifi: mac80211: set up the TX info early to fix failure paths
In the Linux kernel, the following vulnerability has been resolved: w ...
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f ("wifi: mac80211: free ack status frame on TX header build failure") cleaned up the leak, but still left the code a bit messy and the failed SKB didn't get reported to userspace. Fix this up by initialising skb->cb[] earlier, which allows using ieee80211_free_txskb() and therefore reports it for the failure in ieee80211_build_hdr(), and unifies the ieee80211_skb_resize() failure path with it.
EPSS
5.5 Medium
CVSS3