Executive brief
The ath11k WiFi driver in the Linux kernel can crash when processing fragmented wireless packets under certain circumstances, specifically when WiFi access points are restarted frequently. An attacker could trigger this crash by sending specially crafted fragmented WiFi frames, causing the system to become unresponsive and disrupting network connectivity on affected devices.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the ath11k wireless driver's data path (dp_rx.c) when processing fragmented MAC Protocol Data Units (MPDUs). The root cause occurs when fragmented packets are received for a peer whose data path structures (rx_tid and rx_frags) have not been fully initialized. When ath11k_dp_rx_h_sort_frags attempts to traverse an uninitialized fragment queue, it encounters a null socket buffer pointer, causing a kernel panic. The fix adds a dp_setup_done flag check to ensure the peer's fragment handling structures are initialized before processing received fragments. The vulnerability requires network proximity (local WiFi range) to exploit.
Affected products
- Linux Linux kernel affected versions include at least 5.x through 6.x stable branches; fixed in commits a06bfb3c9f69f303692cdae87bc0899d2ae8b2a6 (upstream) and 41efc47f5bc53e63461579e206adc17c4452ab6e (stable)
Timeline
- 2023-04-04: disclosed: Vulnerability reported by Harshitha Prem (Qualcomm)
- 2023-04-17: patched: Patch merged into Linux kernel mainline
- 2023-05-24: other: Patch backported to stable kernel series