From cd21d99e595ec1d8721e1058dcdd4f1f7de1d793 Mon Sep 17 00:00:00 2001

From: Phil Turnbull <philipturnbull@github.com>

Date: Wed, 23 Nov 2022 10:35:40 -0500

Subject: [PATCH] wifi: wilc1000: validate pairwise and authentication suite offsets

Git-commit: cd21d99e595ec1d8721e1058dcdd4f1f7de1d793

Patch-mainline: v6.1-rc8

References: CVE-2022-47520 bsc#1206515

There is no validation of 'offset' which can trigger an out-of-bounds

read when extracting RSN capabilities.

Signed-off-by: Phil Turnbull <philipturnbull@github.com>

Tested-by: Ajay Kathat <ajay.kathat@microchip.com>

Acked-by: Ajay Kathat <ajay.kathat@microchip.com>

Signed-off-by: Kalle Valo <kvalo@kernel.org>

Link: https://lore.kernel.org/r/20221123153543.8568-2-philipturnbull@github.com

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 drivers/staging/wilc1000/wilc_hif.c |   21 ++++++++++++++++-----

 1 file changed, 16 insertions(+), 5 deletions(-)

--- a/drivers/staging/wilc1000/wilc_hif.c

+++ b/drivers/staging/wilc1000/wilc_hif.c

@@ -547,14 +547,25 @@ void *wilc_parse_join_bss_param(struct c

 	rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len);

 	if (rsn_ie) {

+		int rsn_ie_len = sizeof(struct element) + rsn_ie[1];

 		int offset = 8;

-		param->mode_802_11i = 2;

-		param->rsn_found = true;

 		//extract RSN capabilities

-		offset += (rsn_ie[offset] * 4) + 2;

-		offset += (rsn_ie[offset] * 4) + 2;

-		memcpy(param->rsn_cap, &rsn_ie[offset], 2);

+		if (offset < rsn_ie_len) {

+			/* skip over pairwise suites */

+			offset += (rsn_ie[offset] * 4) + 2;

+

+			if (offset < rsn_ie_len) {

+				/* skip over authentication suites */

+				offset += (rsn_ie[offset] * 4) + 2;

+

+				if (offset + 1 < rsn_ie_len) {

+					param->mode_802_11i = 2;

+					param->rsn_found = true;

+					memcpy(param->rsn_cap, &rsn_ie[offset], 2);

+				}

+			}

+		}

 	}

 	if (param->rsn_found) {