From owner-freebsd-wireless@freebsd.org Mon Mar 22 14:15:33 2021
Return-Path: <owner-freebsd-wireless@freebsd.org>
Delivered-To: freebsd-wireless@mailman.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
by mailman.nyi.freebsd.org (Postfix) with ESMTP id 9CA3F5B01C1
for <freebsd-wireless@mailman.nyi.freebsd.org>;
Mon, 22 Mar 2021 14:15:33 +0000 (UTC)
(envelope-from bugzilla-noreply@freebsd.org)
Received: from mailman.nyi.freebsd.org (mailman.nyi.freebsd.org
[IPv6:2610:1c1:1:606c::50:13])
by mx1.freebsd.org (Postfix) with ESMTP id 4F3xNj3XfVz3jjT
for <freebsd-wireless@freebsd.org>; Mon, 22 Mar 2021 14:15:33 +0000 (UTC)
(envelope-from bugzilla-noreply@freebsd.org)
Received: by mailman.nyi.freebsd.org (Postfix)
id 764315AFF5E; Mon, 22 Mar 2021 14:15:33 +0000 (UTC)
Delivered-To: wireless@mailman.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
by mailman.nyi.freebsd.org (Postfix) with ESMTP id 75F375AFF5C
for <wireless@mailman.nyi.freebsd.org>; Mon, 22 Mar 2021 14:15:33 +0000 (UTC)
(envelope-from bugzilla-noreply@freebsd.org)
Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org
[IPv6:2610:1c1:1:606c::19:3])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
client-signature RSA-PSS (4096 bits) client-digest SHA256)
(Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK))
by mx1.freebsd.org (Postfix) with ESMTPS id 4F3xNj2fB6z3jjS
for <wireless@FreeBSD.org>; Mon, 22 Mar 2021 14:15:33 +0000 (UTC)
(envelope-from bugzilla-noreply@freebsd.org)
Received: from kenobi.freebsd.org (kenobi.freebsd.org
[IPv6:2610:1c1:1:606c::50:1d])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
(Client did not present a certificate)
by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 3FC2573A9
for <wireless@FreeBSD.org>; Mon, 22 Mar 2021 14:15:33 +0000 (UTC)
(envelope-from bugzilla-noreply@freebsd.org)
Received: from kenobi.freebsd.org ([127.0.1.5])
by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 12MEFXjT001860
for <wireless@FreeBSD.org>; Mon, 22 Mar 2021 14:15:33 GMT
(envelope-from bugzilla-noreply@freebsd.org)
Received: (from www@localhost)
by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 12MEFXcG001859
for wireless@FreeBSD.org; Mon, 22 Mar 2021 14:15:33 GMT
(envelope-from bugzilla-noreply@freebsd.org)
X-Authentication-Warning: kenobi.freebsd.org: www set sender to
bugzilla-noreply@freebsd.org using -f
From: bugzilla-noreply@freebsd.org
To: wireless@FreeBSD.org
Subject: [Bug 254479] Kernel remote heap overflow in Realtek
RTL8188SU/RTL8191SU/RTL8192SU Wifi Cards driver
Date: Mon, 22 Mar 2021 14:15:33 +0000
X-Bugzilla-Reason: AssignedTo
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: Base System
X-Bugzilla-Component: wireless
X-Bugzilla-Version: CURRENT
X-Bugzilla-Keywords:
X-Bugzilla-Severity: Affects Some People
X-Bugzilla-Who: cutesmilee.business@gmail.com
X-Bugzilla-Status: New
X-Bugzilla-Resolution:
X-Bugzilla-Priority: ---
X-Bugzilla-Assigned-To: wireless@FreeBSD.org
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform
op_sys bug_status bug_severity priority component assigned_to reporter
Message-ID: <bug-254479-21060@https.bugs.freebsd.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: freebsd-wireless@freebsd.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: "Discussions of 802.11 stack,
tools device driver development." <freebsd-wireless.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-wireless>,
<mailto:freebsd-wireless-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-wireless/>
List-Post: <mailto:freebsd-wireless@freebsd.org>
List-Help: <mailto:freebsd-wireless-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-wireless>,
<mailto:freebsd-wireless-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 22 Mar 2021 14:15:33 -0000
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D254479
Bug ID: 254479
Summary: Kernel remote heap overflow in Realtek
RTL8188SU/RTL8191SU/RTL8192SU Wifi Cards driver
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: wireless
Assignee: wireless@FreeBSD.org
Reporter: cutesmilee.business@gmail.com
rsu_raw_xmit() in the last if statement calls rsu_tx_start(), taking a
user-controlled mbuf as parameter.
at the end of the function m_copydata() is called, and it copies the
user-controlled mbuf with the length of the packet / the length of the mbuf
(which isn't checked), the smaller size is taken (the user can provide a big
payload), and the mbuf gets copied to the TX Descriptor struct (struct
r92s_tx_desc) which is 32 bytes.
these vulnerabilities are only for Realtek RTL8188SU/RTL8191SU/RTL8192SU wi=
fi
cards (that are connected via USB?).
vulnerable code:
static int
rsu_tx_start(struct rsu_softc *sc, struct ieee80211_node *ni,=20
struct mbuf *m0, struct rsu_data *data)
{
struct ieee80211vap *vap =3D ni->ni_vap;
struct ieee80211_frame *wh;
struct ieee80211_key *k =3D NULL;
struct r92s_tx_desc *txd;
uint8_t type;
int prio =3D 0;
uint8_t which;
int hasqos;
int xferlen;
int qid;
[...]
xferlen =3D sizeof(*txd) + m0->m_pkthdr.len;
m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]); // <- heap
overflow here
data->buflen =3D xferlen;
data->ni =3D ni;
data->m =3D m0;
STAILQ_INSERT_TAIL(&sc->sc_tx_pending[which], data, next);
/* start transfer, if any */
usbd_transfer_start(sc->sc_xfer[which]);
return (0);
}
--=20
You are receiving this mail because:
You are the assignee for the bug.=