Vladis Dronov c820441a7a nl80211: check for the required netlink attributes presence ...

commit e785fa0a16 upstream.

nl80211_set_rekey_data() does not check if the required attributes
NL80211_REKEY_DATA_{REPLAY_CTR,KEK,KCK} are present when processing
NL80211_CMD_SET_REKEY_OFFLOAD request. This request can be issued by
users with CAP_NET_ADMIN privilege and may result in NULL dereference
and a system crash. Add a check for the required attributes presence.
This patch is based on the patch by bo Zhang.

This fixes CVE-2017-12153.

References: https://bugzilla.redhat.com/show_bug.cgi?id=1491046
Fixes: e5497d766a ("cfg80211/nl80211: support GTK rekey offload")
Reported-by: bo Zhang <zhangbo5891001@gmail.com>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-10-05 09:44:01 +02:00

..

.gitignore

wireless: support internal statically compiled regulatory database

2009-12-21 18:56:10 -05:00

ap.c

cfg80211: export interface stopping function

2014-05-06 15:16:34 +02:00

chan.c

cfg80211: add start / stop NAN commands

2016-09-30 13:21:14 +02:00

core.c

cfg80211: add add_nan_func / del_nan_func

2016-09-30 13:21:23 +02:00

core.h

cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts

2017-01-09 08:32:17 +01:00

db.txt

wireless: support internal statically compiled regulatory database

2009-12-21 18:56:10 -05:00

debugfs.c

cfg80211: remove enum ieee80211_band

2016-04-12 15:56:15 +02:00

debugfs.h

cfg80211/mac80211: use debugfs_remove_recursive

2009-10-30 16:49:18 -04:00

ethtool.c

cfg80211: make ethtool the driver's responsibility

2014-06-23 11:05:33 +02:00

genregdb.awk

wireless: fixup genregdb.awk for remove of antenna gain from wireless-regd

2014-07-21 12:24:20 +02:00

ibss.c

cfg80211: Add support for static WEP in the driver

2016-09-30 13:19:10 +02:00

Kconfig

cfg80211: Fix some linguistics in Kconfig

2016-02-24 09:04:23 +01:00

lib80211_crypt_ccmp.c

lib80211: ratelimit key index mismatch

2015-12-04 14:43:32 +01:00

lib80211_crypt_tkip.c

lib80211: Use skcipher and ahash

2016-01-27 20:36:03 +08:00

lib80211_crypt_wep.c

lib80211: Use skcipher and ahash

2016-01-27 20:36:03 +08:00

lib80211.c

lib80211: remove unused print_ssid()

2014-10-14 02:18:27 +02:00

Makefile

cfg80211: 802.11p OCB mode handling

2014-11-04 13:18:17 +01:00

mesh.c

cfg80211: remove enum ieee80211_band

2016-04-12 15:56:15 +02:00

mlme.c

cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts

2017-01-09 08:32:17 +01:00

nl80211.c

nl80211: check for the required netlink attributes presence

2017-10-05 09:44:01 +02:00

nl80211.h

cfg80211: always notify userspace of new wireless netdevs

2016-08-11 16:51:41 +02:00

ocb.c

cfg80211: ocb: Fix null pointer deref if join_ocb is unimplemented

2015-12-04 14:43:32 +01:00

radiotap.c

cfg80211: add radiotap VHT info to rtap_namespace_sizes

2016-02-24 09:04:41 +01:00

rdev-ops.h

cfg80211: allow the user space to change current NAN configuration

2016-09-30 13:21:28 +02:00

reg.c

cfg80211: make wdev_list accessible to drivers

2016-05-12 11:16:40 +02:00

reg.h

cfg80211: remove enum ieee80211_band

2016-04-12 15:56:15 +02:00

regdb.h

cfg80211: relicense reg.c reg.h and genregdb.awk to ISC

2012-01-04 14:30:41 -05:00

scan.c

cfg80211: limit scan results cache size

2016-11-18 08:44:44 +01:00

sme.c

cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts

2017-01-09 08:32:17 +01:00

sysfs.c

cfg80211: check rdev resume callback only for registered wiphy

2017-04-12 12:41:11 +02:00

sysfs.h

net: misc: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

trace.c

cfg80211: add tracing to rdev-ops

2012-10-18 10:53:37 +02:00

trace.h

cfg80211: allow the user space to change current NAN configuration

2016-09-30 13:21:28 +02:00

util.c

mac80211: strictly check mesh address extension mode

2017-06-24 07:11:13 +02:00

wext-compat.c

cfg80211: Add support for static WEP in the driver

2016-09-30 13:19:10 +02:00

wext-compat.h

cfg80211-wext: export symbols only when needed

2015-02-28 21:31:09 +01:00

wext-core.c

Revert "wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel"

2016-08-08 08:49:50 +02:00

wext-priv.c

wext: fix potential private ioctl memory content leak

2010-09-20 13:41:40 -04:00

wext-proc.c

net: proc: change proc_net_remove to remove_proc_entry

2013-02-18 14:53:08 -05:00

wext-sme.c

cfg80211: Add support for static WEP in the driver

2016-09-30 13:19:10 +02:00

wext-spy.c

wireless: Convert compare_ether_addr to ether_addr_equal

2012-05-09 20:49:19 -04:00