Описание
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: don't get the radio mask for netdev-less wdevs
cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with
wdev->netdev, which can be NULL and then crashes in mac80211.
To avoid that, invert the order of checks since wdev->netdev
is always valid for beaconing interfaces.
A flaw was found in the Linux kernel's wireless configuration subsystem (cfg80211). When calculating beacon interval data, the system attempts to retrieve radio mask information for wireless devices that lack an associated network interface without proper validation. A local attacker can exploit this flaw to cause a null pointer dereference, crashing the system and resulting in a Denial of Service (DoS).
Отчет
A low impact flaw was found in the Linux kernel's wireless configuration subsystem (cfg80211). When calculating beacon interval data, cfg80211_calculate_bi_data() passes the network device pointer of a wireless device (wdev) that has no associated netdev to rdev_get_radio_mask(), and the resulting NULL pointer dereference in mac80211 crashes the kernel. A local attacker able to exercise this wireless configuration path can cause a denial of service, with no impact on confidentiality or integrity, which is consistent with the Red Hat CVSS 3.1 score of 5.5 (MODERATE) and the overall low impact assessment. Affected Red Hat products are Red Hat Enterprise Linux 9 (from the 9.6 update stream onward), Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS, and Red Hat OpenShift versions shipping the affected RHEL 9 based CoreOS kernel (OpenShift 4.19 onward and OpenShift 5). Fixes for these streams are currently deferred given the low impact and the local, availability-only nature of the flaw; the residual risk is that a local user who can trigger the affected cfg80211 beacon-interval calculation on a netdev-less wireless device can crash the system. Red Hat Enterprise Linux 7 and 8, earlier Red Hat Enterprise Linux 9 update streams, and earlier OpenShift releases are not affected because the vulnerable code is not present in those kernels, and Red Hat Enterprise Linux 6 is out of support.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with wdev->netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since wdev->netdev is always valid for beaconing interfaces.
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with wdev->netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since wdev->netdev is always valid for beaconing interfaces.
In the Linux kernel, the following vulnerability has been resolved: w ...
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with wdev->netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since wdev->netdev is always valid for beaconing interfaces.
EPSS
5.5 Medium
CVSS3