Executive brief
The Linux kernel's wireless networking interface (nl80211) contains an integer overflow vulnerability in its MBSSID (Multiple BSSID) element parsing function. An authenticated attacker with CAP_NET_ADMIN capabilities on a system with compatible wireless hardware could exploit this to cause a heap buffer overflow, leading to potential denial of service or privilege escalation.
Technical details
The vulnerability is an integer overflow in nl80211_parse_mbssid_elems(), which uses an unsigned 8-bit variable (u8) to count MBSSID elements from a nested netlink attribute. When a user supplies 256 or more elements, the counter wraps to 0, causing a heap buffer overflow when the array is allocated and written to based on the overflowed count. The vulnerability is limited to devices with the wiphy->mbssid_max_interfaces member configured in the driver and requires CAP_NET_ADMIN (network administrator) privileges to trigger. The fix adds a check to reject requests with 255 or more elements, preventing the overflow condition.
Affected products
- Linux Linux kernel kernel versions prior to the fix (commit 6311071a056272e1e761de8d0305e87cc566f734)
Timeline
- 2023-08-09: disclosed
- 2023-08-09: patched