In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure ieee80211_tx_prepare_skb() has three error paths, but only two of them free the skb. The first error path (ieee80211_tx_prepare() returning TX_DROP) does not free it, while invoke_tx_handlers() failure and the fragmentation check both do. Add kfree_skb() to the first error path so all three are consistent, and remove the now-redundant frees in callers (ath9k, mt76, mac80211_hwsim) to avoid double-free. Document the skb ownership guarantee in the function's kdoc.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: wifi: mac80211: liberar siempre skb en caso de fallo de ieee80211_tx_prepare_skb() ieee80211_tx_prepare_skb() tiene tres rutas de error, pero solo dos de ellas liberan el skb. La primera ruta de error (ieee80211_tx_prepare() devolviendo TX_DROP) no lo libera, mientras que el fallo de invoke_tx_handlers() y la comprobación de fragmentación sí lo hacen. Añadir kfree_skb() a la primera ruta de error para que las tres sean consistentes, y eliminar las liberaciones ahora redundantes en las funciones que llaman (ath9k, mt76, mac80211_hwsim) para evitar la doble liberación. Documentar la garantía de propiedad del skb en el kdoc de la función.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-401
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbc46740> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd369d6f080> | Operating System |
| linux | linux_kernel | 3.13 | <built-in method update of dict object at 0x7fd36ae4ab40> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd3694e1140> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd2dbc45a00> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd369d6c380> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36821a640> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36ae49a00> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd39c47ff40> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd34118d080> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:3.13:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* |