Executive brief
The Linux kernel's WiFi configuration module (cfg80211) did not properly validate authentication and association requests when an access point claimed to use the same MAC address as the connecting device. An attacker could exploit this to cause WiFi connection failures or potentially interfere with legitimate wireless network operations, affecting any Linux system with WiFi connectivity.
Technical details
The vulnerability exists in the net/wireless/mlme.c file of the Linux kernel's cfg80211 module, which handles WiFi authentication and association. The flaw is a missing address validation check in the cfg80211_mlme_auth() and cfg80211_mlme_assoc() functions. An attacker could craft a malicious WiFi access point that advertises the same MAC address (BSSID or MLD address) as the connecting device, bypassing normal connection validation. The kernel would then attempt to process invalid connection requests, leading to failed authentication attempts and potential denial of service. The patch adds explicit checks to reject such spoofed access points before attempting connection. No special privileges or user interaction are required beyond WiFi network proximity.
Affected products
- Linux Linux Kernel multiple versions prior to fix in August 2023
Timeline
- 2023-08-15: disclosed
- 2023-08-22: patched