UBUNTU: SAUCE: wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans()

In the copy code of the elements, we do the following calculation
to reach the end of the MBSSID element:

	/* copy the IEs after MBSSID */
	cpy_len = mbssid[1] + 2;

This looks fine, however, cpy_len is a u8, the same as mbssid[1],
so the addition of two can overflow. In this case the subsequent
memcpy() will overflow the allocated buffer, since it copies 256
bytes too much due to the way the allocation and memcpy() sizes
are calculated.

Fix this by using size_t for the cpy_len variable.

This fixes CVE-2022-41674.

Reported-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
CVE-2022-41674
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Kamal Mostafa <kamal@canonical.com>
Acked-by: Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 1a8b76c9dd567a0e7d698202eae78a03cffc3fdb..d9ab37a798f4375e021c2b205c3dd6a0d02a895b 100644 (file)
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -2238,7 +2238,7 @@ cfg80211_update_notlisted_nontrans(struct wiphy *wiphy,
        size_t new_ie_len;
        struct cfg80211_bss_ies *new_ies;
        const struct cfg80211_bss_ies *old;
-       u8 cpy_len;
+       size_t cpy_len;
 
        lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);