leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
5d3516b364
linux/net/mac80211
History
Wen Gong 3edc6b0d6c mac80211: extend protection against mixed key and fragment cache attacks 
For some chips/drivers, e.g., QCA6174 with ath10k, the decryption is
done by the hardware, and the Protected bit in the Frame Control field
is cleared in the lower level driver before the frame is passed to
mac80211. In such cases, the condition for ieee80211_has_protected() is
not met in ieee80211_rx_h_defragment() of mac80211 and the new security
validation steps are not executed.

Extend mac80211 to cover the case where the Protected bit has been
cleared, but the frame is indicated as having been decrypted by the
hardware. This extends protection against mixed key and fragment cache
attack for additional drivers/chips. This fixes CVE-2020-24586 and
CVE-2020-24587 for such cases.

Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1

Cc: stable@vger.kernel.org
Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20210511200110.037aa5ca0390.I7bb888e2965a0db02a67075fcb5deb50eb7408aa@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2021-05-11 20:14:50 +02:00
..
aead_api.c mac80211: Check crypto_aead_encrypt for errors 2021-03-16 21:20:41 +01:00
aead_api.h
aes_ccm.h
aes_cmac.c mac80211: aes_cmac: check crypto_shash_setkey() return value 2021-04-19 12:01:40 +02:00
aes_cmac.h
aes_gcm.h
aes_gmac.c mac80211: Check crypto_aead_encrypt for errors 2021-03-16 21:20:41 +01:00
aes_gmac.h
agg-rx.c mac80211: use bitfield helpers for BA session action frames 2020-12-11 13:20:05 +01:00
agg-tx.c mac80211: use bitfield helpers for BA session action frames 2020-12-11 13:20:05 +01:00
airtime.c mac80211: add AQL support for VHT160 tx rates 2020-09-18 11:36:03 +02:00
cfg.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2021-04-09 20:48:35 -07:00
chan.c mac80211: Update rate control on channel change 2020-12-11 13:20:05 +01:00
debug.h
debugfs_key.c mac80211: remove trailing semicolon in macro definitions 2020-12-11 12:51:55 +01:00
debugfs_key.h
debugfs_netdev.c mac80211: remove trailing semicolon in macro definitions 2020-12-11 12:51:55 +01:00
debugfs_netdev.h
debugfs_sta.c wireless: fix spelling of A-MSDU in HE capabilities 2021-04-19 12:50:15 +02:00
debugfs_sta.h
debugfs.c mac80211: Allow concurrent monitor iface and ethernet rx decap 2021-04-08 15:21:05 +02:00
debugfs.h
driver-ops.c mac80211: fix station rate table updates on assoc 2021-02-01 15:07:09 +01:00
driver-ops.h mac80211: add rx decapsulation offload support 2021-01-21 13:34:49 +01:00
ethtool.c
fils_aead.c
fils_aead.h
he.c mac80211: reduce peer HE MCS/NSS to own capabilities 2021-01-22 09:11:28 +01:00
ht.c mac80211: Use fallthrough pseudo-keyword 2020-07-31 09:24:23 +02:00
ibss.c mac80211: fix double free in ibss_leave 2021-03-16 21:13:09 +01:00
ieee80211_i.h mac80211: check defrag PN against current frame 2021-05-11 20:13:45 +02:00
iface.c mac80211: add fragment cache to sta_info 2021-05-11 20:13:35 +02:00
Kconfig ath9k: fix build error with LEDS_CLASS=m 2021-01-28 09:29:34 +02:00
key.c mac80211: prevent mixed key and fragment cache attacks 2021-05-11 20:12:51 +02:00
key.h mac80211: prevent mixed key and fragment cache attacks 2021-05-11 20:12:51 +02:00
led.c
led.h
main.c mac80211: drop the connection if firmware crashed while in CSA 2021-04-19 12:06:44 +02:00
Makefile mac80211: remove legacy minstrel rate control 2021-01-22 09:11:37 +01:00
mesh_hwmp.c mac80211: fix potential overflow when multiplying to u32 integers 2021-02-12 08:54:42 +01:00
mesh_pathtbl.c mac80211: mesh: fix mesh_pathtbl_init() error path 2020-12-04 17:34:25 -08:00
mesh_plink.c mac80211: fix some more kernel-doc in mesh 2020-09-28 14:36:53 +02:00
mesh_ps.c mac80211: fix some more kernel-doc in mesh 2020-09-28 14:36:53 +02:00
mesh_sync.c
mesh.c mac80211: save HE oper info in BSS config for mesh 2020-11-06 10:03:21 +01:00
mesh.h mac80211: add HE 6 GHz Band Capability element 2020-05-31 11:26:39 +02:00
michael.c
michael.h
mlme.c Another set of updates, all over the map: 2021-04-20 16:44:04 -07:00
ocb.c
offchannel.c mac80211: Inform AP when returning operating channel 2020-09-28 13:18:53 +02:00
pm.c cfg80211: avoid holding the RTNL when calling the driver 2021-01-26 11:55:50 +01:00
rate.c mac80211: fix station rate table updates on assoc 2021-02-01 15:07:09 +01:00
rate.h mac80211: populate debugfs only after cfg80211 init 2020-04-24 11:30:13 +02:00
rc80211_minstrel_ht_debugfs.c mac80211: minstrel_ht: show sampling rates in debugfs 2021-02-12 08:58:11 +01:00
rc80211_minstrel_ht.c mac80211: minstrel_ht: remove extraneous indentation on if statement 2021-04-19 12:00:48 +02:00
rc80211_minstrel_ht.h mac80211: minstrel_ht: remove sample rate switching code for constrained devices 2021-02-12 08:58:22 +01:00
rx.c mac80211: extend protection against mixed key and fragment cache attacks 2021-05-11 20:14:50 +02:00
s1g.c mac80211: initialize last_rate for S1G STAs 2020-10-08 10:40:57 +02:00
scan.c mac80211: convert S1G beacon to scan results 2020-09-28 13:53:25 +02:00
spectmgmt.c mac80211: 160MHz with extended NSS BW in CSA 2021-01-21 13:39:11 +01:00
sta_info.c mac80211: add fragment cache to sta_info 2021-05-11 20:13:35 +02:00
sta_info.h mac80211: prevent attacks on TKIP/WEP as well 2021-05-11 20:14:11 +02:00
status.c mac80211: enable QoS support for nl80211 ctrl port 2021-02-12 08:52:48 +01:00
tdls.c cfg80211: avoid holding the RTNL when calling the driver 2021-01-26 11:55:50 +01:00
tkip.c
tkip.h
trace_msg.h
trace.c
trace.h mac80211: add rx decapsulation offload support 2021-01-21 13:34:49 +01:00
tx.c Another set of updates, all over the map: 2021-04-20 16:44:04 -07:00
util.c mac80211: make ieee80211_vif_to_wdev work when the vif isn't in the driver 2021-04-19 12:03:13 +02:00
vht.c mac80211: remove NSS number of 160MHz if not support 160MHz for HE 2021-01-21 13:45:13 +01:00
wep.c
wep.h
wme.c mac80211: remove WDS-related code 2020-11-11 08:39:13 +01:00
wme.h
wpa.c mac80211: check defrag PN against current frame 2021-05-11 20:13:45 +02:00
wpa.h