Описание
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: require a peer station for TDLS setup confirm
It's nonsense for the setup confirm to go to station that
doesn't even exist, and it hits a warning when building
the frame:
WARN_ON_ONCE(!sta || !ap_sta)
Only accept WLAN_TDLS_SETUP_CONFIRM when the station is
already there as a TDLS station. Need to copy the call
to ieee80211_tdls_prep_mgmt_packet() since the existing
WLAN_TDLS_DISCOVERY_REQUEST already falls through to it.
A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker can cause a denial of service (DoS) by requesting a Tunneled Direct Link Setup (TDLS) setup confirmation for a nonexistent peer station. Because the subsystem does not verify that the peer station exists before preparing the management frame, this issue triggers an internal kernel warning that may result in system instability or a crash.
Отчет
A low impact denial of service flaw was found in the Linux kernel's mac80211 wireless subsystem, affecting the kernel as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4 and 5 releases (via their RHEL CoreOS-based kernels). When handling a Tunneled Direct Link Setup (TDLS) setup confirmation for a peer station that does not exist, mac80211 prepares the management frame without first verifying that the TDLS peer station is present, which triggers the WARN_ON_ONCE(!sta || !ap_sta) assertion in net/mac80211/tdls.c. A local user able to issue TDLS management commands (for example through nl80211) can exploit this to cause a kernel warning; on systems where the panic_on_warn kernel option is enabled, the warning results in a kernel panic, causing a local denial of service. Confidentiality and integrity are not affected. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in its kernel, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope. While the CVSS:3.1 base score for this flaw is 5.5 (Moderate), Red Hat rates its impact as Low because the effect is limited to a kernel warning, and a system crash occurs only when panic_on_warn is enabled. Given the low impact and the local access required, the fix is deferred and will be addressed in a future scheduled kernel update; the residual risk until then is a local denial of service by an attacker who already has local access to the system.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer station for TDLS setup confirm It's nonsense for the setup confirm to go to station that doesn't even exist, and it hits a warning when building the frame: WARN_ON_ONCE(!sta || !ap_sta) Only accept WLAN_TDLS_SETUP_CONFIRM when the station is already there as a TDLS station. Need to copy the call to ieee80211_tdls_prep_mgmt_packet() since the existing WLAN_TDLS_DISCOVERY_REQUEST already falls through to it.
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer station for TDLS setup confirm It's nonsense for the setup confirm to go to station that doesn't even exist, and it hits a warning when building the frame: WARN_ON_ONCE(!sta || !ap_sta) Only accept WLAN_TDLS_SETUP_CONFIRM when the station is already there as a TDLS station. Need to copy the call to ieee80211_tdls_prep_mgmt_packet() since the existing WLAN_TDLS_DISCOVERY_REQUEST already falls through to it.
wifi: mac80211: require a peer station for TDLS setup confirm
In the Linux kernel, the following vulnerability has been resolved: w ...
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer station for TDLS setup confirm It's nonsense for the setup confirm to go to station that doesn't even exist, and it hits a warning when building the frame: WARN_ON_ONCE(!sta || !ap_sta) Only accept WLAN_TDLS_SETUP_CONFIRM when the station is already there as a TDLS station. Need to copy the call to ieee80211_tdls_prep_mgmt_packet() since the existing WLAN_TDLS_DISCOVERY_REQUEST already falls through to it.
EPSS
5.5 Medium
CVSS3