Описание
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't allow injecting frames wider than the chanctx
Frames injected on a monitor interface can carry a radiotap
field requesting a bandwidth, which mac80211 passes down to
the driver regardless of the the actual operational bandwidth.
If the bandwidth requested is too wide, that triggers a warning
in hwsim:
WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw))
Drop such frames entirely instead since they cannot be sent.
A flaw was found in the Linux kernel's mac80211 wireless networking subsystem. When packets are injected on a monitor network interface, mac80211 does not verify whether the bandwidth requested in the radiotap header exceeds the operational channel bandwidth before forwarding it to the driver. A local user with packet injection capabilities could exploit this vulnerability by injecting frames requesting excessive bandwidth, triggering kernel warnings or unexpected driver states that may result in a Denial of Service (DoS).
Отчет
A low impact flaw was found in the Linux kernel's mac80211 wireless networking subsystem, affecting the Red Hat Enterprise Linux 8, 9, and 10 kernels (kernel and kernel-rt), Red Hat In-Vehicle OS, and the RHEL CoreOS kernels shipped with OpenShift Container Platform 4. Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth wider than the operational channel bandwidth of the channel context; mac80211 passed this value down to the wireless driver without validating it against the channel context, which can trigger kernel warnings (such as a WARN_ON in mac80211_hwsim) or unexpected driver states. A local user with the ability to inject frames on a monitor interface, which requires privileges such as CAP_NET_RAW, could exploit this flaw to cause a local denial of service, with no impact to confidentiality or integrity. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that release. Red Hat rated the impact of this flaw as Low because exploitation requires privileged local access and packet injection capability on a monitor interface, the typical consequence is driver warnings and log flooding rather than memory corruption, and a high availability impact is possible only on systems where panic_on_warn is enabled; this is lower than the MODERATE severity suggested by the Red Hat CVSS:3.1 score of 5.5. Because of the low impact, fixes for the affected product streams are deferred to future updates; the residual risk is limited to a local denial of service by an already-privileged local user with packet-injection capability.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual operational bandwidth. If the bandwidth requested is too wide, that triggers a warning in hwsim: WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)) Drop such frames entirely instead since they cannot be sent.
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual operational bandwidth. If the bandwidth requested is too wide, that triggers a warning in hwsim: WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)) Drop such frames entirely instead since they cannot be sent.
wifi: mac80211: don't allow injecting frames wider than the chanctx
In the Linux kernel, the following vulnerability has been resolved: w ...
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual operational bandwidth. If the bandwidth requested is too wide, that triggers a warning in hwsim: WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)) Drop such frames entirely instead since they cannot be sent.
EPSS
5.5 Medium
CVSS3