CVE-2016-8658: Buffer Overflow
A stack based buffer overflow vulnerability was found in brcmfcfg80211startap() function. User-space can choose to omit NL80211ATTRSSID and only provide raw IE TLV data. When doing so it can provide SSID IE with length exceeding the allowed size. The driver further processes this IE copying it into a local variable without checking the length. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
References:
http://seclists.org/oss-sec/2016/q4/111
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ded89912156b1a47d940a0c954c43afbabd0c42c
Other sources
Stack-based buffer overflow in the brcmfcfg80211startap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.7.5 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a long SSID Information Element in a command to a Netlink socket.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-8658?
CVE-2016-8658 is a vulnerability that refers to a stack-based buffer overflow in the brcmf_cfg80211_start_ap function in the Linux kernel.
How severe is CVE-2016-8658?
CVE-2016-8658 has a severity level of low.
How does CVE-2016-8658 impact the system?
CVE-2016-8658 can cause a denial of service (system crash) or possibly have unspecified other impact.
Which Linux kernel versions are affected by CVE-2016-8658?
Linux kernel versions before 4.7.5 are affected by CVE-2016-8658.
How can I fix CVE-2016-8658?
To fix CVE-2016-8658, update your Linux kernel to version 4.7.5 or later.