In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix NULL pointer dereference in meshrxcsaframe()

In meshrxcsaframe(), elems->meshchanswparamsie is dereferenced at lines 1638 and 1642 without a prior NULL check:

ifmsh->chswttl = elems->meshchanswparamsie->meshttl; ... prevalue = le16tocpu(elems->meshchanswparamsie->meshprevalue);

The meshmatcheslocal() check above only validates the Mesh ID, Mesh Configuration, and Supported Rates IEs. It does not verify the presence of the Mesh Channel Switch Parameters IE (element ID 118). When a received CSA action frame omits that IE, ieee80211parseelems() leaves elems->meshchanswparamsie as NULL, and the unconditional dereference causes a kernel NULL pointer dereference.

A remote mesh peer with an established peer link (PLINKESTAB) can trigger this by sending a crafted SPECTRUMMGMT/CHLSWITCH action frame that includes a matching Mesh ID and Mesh Configuration IE but omits the Mesh Channel Switch Parameters IE. No authentication beyond the default open mesh peering is required.

Crash confirmed on kernel 6.17.0-5-generic via mac80211hwsim:

BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:ieee80211meshrxqueuedmgmt+0x143/0x2a0 [mac80211] CR2: 0000000000000000

Fix by adding a NULL check for meshchanswparamsie after meshmatcheslocal() returns, consistent with how other optional IEs are guarded throughout the mesh code.

The bug has been present since v3.13 (released 2014-01-19).

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix NULL deref in meshmatcheslocal()

meshmatcheslocal() unconditionally dereferences ie->meshconfig to compare mesh configuration parameters. When called from meshrxcsaframe(), the parsed action-frame elements may not contain a Mesh Configuration IE, leaving ie->meshconfig NULL and triggering a kernel NULL pointer dereference.

The other two callers are already safe: - ieee80211meshrxbcnpresp() checks !elems->meshconfig before calling meshmatcheslocal() - meshplinkgetevent() is only reached through meshprocessplinkframe(), which checks !elems->meshconfig, too

meshrxcsaframe() is the only caller that passes raw parsed elements to meshmatcheslocal() without guarding meshconfig. An adjacent attacker can exploit this by sending a crafted CSA action frame that includes a valid Mesh ID IE but omits the Mesh Configuration IE, crashing the kernel.

The captured crash log:

Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: eventsunbound cfg80211wiphywork [...] Call Trace: <TASK> ? pfxmeshmatcheslocal (net/mac80211/mesh.c:65) ieee80211meshrxqueuedmgmt (net/mac80211/mesh.c:1686) [...] ieee80211ifacework (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802) [...] cfg80211wiphywork (net/wireless/core.c:426) processonework (net/kernel/workqueue.c:3280) ? assignwork (net/kernel/workqueue.c:1219) workerthread (net/kernel/workqueue.c:3352) ? pfxworkerthread (net/kernel/workqueue.c:3385) kthread (net/kernel/kthread.c:436) [...] retfromforkasm (net/arch/x86/entry/entry64.S:255) </TASK>

This patch adds a NULL check for ie->meshconfig at the top of meshmatcheslocal() to return false early when the Mesh Configuration IE is absent.