From patchwork Thu Nov 21 16:04:38 2019

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit

X-Patchwork-Submitter: Ganapathi Bhat <gbhat@marvell.com>

X-Patchwork-Id: 11256477

X-Patchwork-Delegate: kvalo@adurom.com

Return-Path: <SRS0=bi0l=ZN=vger.kernel.org=linux-wireless-owner@kernel.org>

Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org

 [172.30.200.123])

	by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id AAABF138C

	for <patchwork-linux-wireless@patchwork.kernel.org>;

 Thu, 21 Nov 2019 16:04:48 +0000 (UTC)

Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])

	by mail.kernel.org (Postfix) with ESMTP id 8950220637

	for <patchwork-linux-wireless@patchwork.kernel.org>;

 Thu, 21 Nov 2019 16:04:48 +0000 (UTC)

Authentication-Results: mail.kernel.org;

	dkim=pass (2048-bit key) header.d=marvell.com header.i=@marvell.com

 header.b="nkGygBtm"

Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand

        id S1727141AbfKUQEs (ORCPT

        <rfc822;patchwork-linux-wireless@patchwork.kernel.org>);

        Thu, 21 Nov 2019 11:04:48 -0500

Received: from mx0b-0016f401.pphosted.com ([67.231.156.173]:6582 "EHLO

        mx0b-0016f401.pphosted.com" rhost-flags-OK-OK-OK-OK)

        by vger.kernel.org with ESMTP id S1726980AbfKUQEr (ORCPT

        <rfc822;linux-wireless@vger.kernel.org>);

        Thu, 21 Nov 2019 11:04:47 -0500

Received: from pps.filterd (m0045851.ppops.net [127.0.0.1])

        by mx0b-0016f401.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id

 xALFu718003199;

        Thu, 21 Nov 2019 08:04:44 -0800

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com;

 h=from : to : cc :

 subject : date : message-id : mime-version : content-type; s=pfpt0818;

 bh=o/oIGGHPmwt5MFTKPl2GcISKabBWhPBOdPXPhlV+8H8=;

 b=nkGygBtmdc1LxIp0VzpsKssm8mQFI+syng1Rek/N5Fx3Vz4o2KAlRceJkhXNdV7WpjTG

 XDtRj/LiYd+OAIqSLM6J2VNtOKOhaNSDydtTUnIi4imHPzYoAdESDQW5aFV8JKZqOfYx

 0oQTjw6AhdjJCsngL+bImzmnJoZsc2gUu3BAic/kW+6Uj0JCgQwoUFBH9rNaO+Q33BY+

 dZy9MdKD905LxSBE7A5xWx5GEgrqRcvfxSOu2K78FQhsJ20suhvWSobxpYE0LIrajl6s

 oQGuDbTsdOO/8v7D9Xn7zObUH6qZ08AMxDZNaBLqiKpjFY/RA7LbR2eulwEnhjCLDQfK uA==

Received: from sc-exch03.marvell.com ([199.233.58.183])

        by mx0b-0016f401.pphosted.com with ESMTP id 2wd090yntp-1

        (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT);

        Thu, 21 Nov 2019 08:04:44 -0800

Received: from SC-EXCH01.marvell.com (10.93.176.81) by SC-EXCH03.marvell.com

 (10.93.176.83) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Thu, 21 Nov

 2019 08:04:43 -0800

Received: from maili.marvell.com (10.93.176.43) by SC-EXCH01.marvell.com

 (10.93.176.81) with Microsoft SMTP Server id 15.0.1367.3 via Frontend

 Transport; Thu, 21 Nov 2019 08:04:43 -0800

Received: from testmailhost.marvell.com (testmailhost.marvell.com

 [10.31.130.105])

        by maili.marvell.com (Postfix) with ESMTP id 898743F703F;

        Thu, 21 Nov 2019 08:04:40 -0800 (PST)

From: Ganapathi Bhat <gbhat@marvell.com>

To: <linux-wireless@vger.kernel.org>

CC: Cathy Luo <cluo@marvell.com>, Zhiyuan Yang <yangzy@marvell.com>,

        James Cao <jcao@marvell.com>,

        Rakesh Parmar <rakeshp@marvell.com>,

        Brian Norris <briannorris@chromium.org>,

        Mohammad Tausif Siddiqui <msiddiqu@redhat.com>,

        huangwen <huangwenabc@gmail.com>,

        Ganapathi Bhat <gbhat@marvell.com>

Subject: [PATCH] mwifiex: fix possible heap overflow in

 mwifiex_process_country_ie()

Date: Thu, 21 Nov 2019 21:34:38 +0530

Message-ID: <1574352278-7592-1-git-send-email-gbhat@marvell.com>

X-Mailer: git-send-email 1.9.1

MIME-Version: 1.0

X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.95,18.0.572

 definitions=2019-11-21_03:2019-11-21,2019-11-21 signatures=0

Sender: linux-wireless-owner@vger.kernel.org

Precedence: bulk

List-ID: <linux-wireless.vger.kernel.org>

X-Mailing-List: linux-wireless@vger.kernel.org

mwifiex_process_country_ie() function parse elements of bss

descriptor in beacon packet. When processing WLAN_EID_COUNTRY

element, there is no upper limit check for country_ie_len before

calling memcpy. The destination buffer domain_info->triplet is an

array of length MWIFIEX_MAX_TRIPLET_802_11D(83). The remote

attacker can build a fake AP with the same ssid as real AP, and

send malicous beacon packet with long WLAN_EID_COUNTRY elemen

(country_ie_len > 83). Attacker can  force STA connect to fake AP

on a different channel. When the victim STA connects to fake AP,

will trigger the heap buffer overflow. Fix this by checking for

length and if found invalid, don not connect to the AP.

This fix addresses CVE-2019-14895.

Reported-by: huangwen <huangwenabc@gmail.com>

Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>

---

 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 13 +++++++++++--

 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c

index 74e5056..6dd835f 100644

--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c

+++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c

@@ -229,6 +229,14 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,

 			    "11D: skip setting domain info in FW\n");

 		return 0;

 	}

+

+	if (country_ie_len >

+	    (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) {

+		mwifiex_dbg(priv->adapter, ERROR,

+			    "11D: country_ie_len overflow!, deauth AP\n");

+		return -EINVAL;

+	}

+

 	memcpy(priv->adapter->country_code, &country_ie[2], 2);

 	domain_info->country_code[0] = country_ie[2];

@@ -272,8 +280,9 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,

 	priv->scan_block = false;

 	if (bss) {

-		if (adapter->region_code == 0x00)

-			mwifiex_process_country_ie(priv, bss);

+		if (adapter->region_code == 0x00 &&

+		    mwifiex_process_country_ie(priv, bss))

+			return -EINVAL;

 		/* Allocate and fill new bss descriptor */

 		bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor),