CVE-2022-49112: mt76: fix monitor mode crash with sdio driver
In the Linux kernel, the following vulnerability has been resolved:
mt76: fix monitor mode crash with sdio driver
mt7921s driver may receive frames with fragment buffers. If there is a CTS packet received in monitor mode, the payload is 10 bytes only and need 6 bytes header padding after RXD buffer. However, only RXD in the first linear buffer, if we pull buffer size RXD-size+6 bytes with skbpull(), that would trigger "BUGON(skb->len < skb->datalen)" in skbpull().
To avoid the nonlinear buffer issue, enlarge the RXD size from 128 to 256 to make sure all MCU operation in linear buffer.
[ 52.007562] kernel BUG at include/linux/skbuff.h:2313! [ 52.007578] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 52.007987] pc : skbpull+0x48/0x4c [ 52.008015] lr : mt7921queuerxskb+0x494/0x890 [mt7921common] [ 52.008361] Call trace: [ 52.008377] skbpull+0x48/0x4c [ 52.008400] mt76snetworker+0x134/0x1b0 [mt76sdio 35339a92c6eb7d4bbcc806a1d22f56365565135c] [ 52.008431] mt76workerfn+0xe8/0x170 [mt76 ef716597d11a77150bc07e3fdd68eeb0f9b56917] [ 52.008449] kthread+0x148/0x3ac [ 52.008466] retfromfork+0x10/0x30
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (mt76/mt7921s sdio driver)to a version that resolves this vulnerability.Patch mt76: fix monitor mode crash with sdio driver - Configuration
To avoid the nonlinear buffer issue and prevent the monitor-mode crash, enlarge the RXD size from 128 and ensure there are 6 bytes of header padding after the RXD buffer so that skb_pull() does not attempt to pull more data than available in the first linear buffer.
mt7921s/mt76 RXD ring buffer RXD size = enlarge from 128 to (RXD-size + 6 bytes linear buffer / add 6 bytes header padding after RXD buffer)
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the mt7921s SDIO wireless driver are exposed when the interface is operating in monitor mode. The failure is associated with receiving a CTS packet whose payload is split into fragment buffers.
What does an attacker need to trigger the failure?
The CVSS vector indicates local access and low privileges are required, with no user interaction. The described trigger also requires the vulnerable driver to process the relevant received traffic while in monitor mode.
What is the observable impact if the issue is triggered?
The kernel can hit a BUG in skb_pull and generate an Oops, resulting in a denial of service. The provided CVSS vector lists availability impact as high and no confidentiality or integrity impact.
How can I identify a likely occurrence?
Affected systems may log a kernel BUG at include/linux/skbuff.h:2313, with skb_pull and mt7921_queue_rx_skb in the call trace. The trace may also include mt76s_net_worker and the mt76_sdio module.