title: wifi: iwlwifi: mvm: Fix a memory corruption issue
description: In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: Fix a memory corruption issue
A few lines above, space is kzalloc()'ed for:
sizeof(struct iwl_nvm_data) +
sizeof(struct ieee80211_channel) +
sizeof(struct ieee80211_rate)
'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine.
At the end of this structure, there is the 'channels' flex array.
Each element is of type 'struct ieee80211_channel'.
So only 1 element is allocated in this array.
When doing:
mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels;
We point at the first element of the 'channels' flex array.
So this is fine.
However, when doing:
mvm->nvm_data->bands[0].bitrates =
(void *)((u8 *)mvm->nvm_data->channels + 1);
because of the "(u8 *)" cast, we add only 1 to the address of the beginning
of the flex array.
It is likely that we want point at the 'struct ieee80211_rate' allocated
just after.
Remove the spurious casting so that the pointer arithmetic works as
expected.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 8ca151b568b6, lessThan: 7c8faa310803, status: affected, versionType: git
version: 8ca151b568b6, lessThan: 6b3223449c95, status: affected, versionType: git
version: 8ca151b568b6, lessThan: f06cdd8d4ba5, status: affected, versionType: git
version: 8ca151b568b6, lessThan: 8ba438ef3cac, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 3.9, status: affected
version: 0, lessThan: 3.9, status: unaffected, versionType: custom
version: 5.15.135, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.57, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.5.7, lessThanOrEqual: 6.5.*, status: unaffected, versionType: custom
version: 6.6, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
