In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx after the VLAN change.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mac80211: comprobar/borrar fast rx para cambios de VLAN que no sean 4addr sta Al mover una estación fuera de una VLAN y eliminar la VLAN después, la entrada fast_rx todavía contiene un puntero a netdev de la VLAN, lo que puede causar errores de uso después de la liberación. Solucione este problema llamando inmediatamente a ieee80211_check_fast_rx después del cambio de VLAN.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-416
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384ea9140> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384e568c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384ea9a00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4672c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384eaa200> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384ea9080> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384dd0340> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2d3f2ba00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3105cb680> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384ea8ec0> | Operating System |
| linux | linux_kernel | 5.12 | <built-in method update of dict object at 0x7fd384dd1300> | Operating System |
| linux | linux_kernel | 5.12 | <built-in method update of dict object at 0x7fd39c4baa00> | Operating System |
| linux | linux_kernel | 5.12 | <built-in method update of dict object at 0x7fd384ea81c0> | Operating System |
| linux | linux_kernel | 6.9 | <built-in method update of dict object at 0x7fd384df6a80> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd3703cdd80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.12:rc7:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.12:rc8:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |