In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
link_id is taken from the ML Reconfiguration element (control & 0x000f),
so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS
(15) elements, so index 15 is out-of-bounds. Skip subelements with
link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds
write.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 5
https://git.kernel.org/stable/c/162d331d833dc73a3e905a24c44dd33732af1fc5
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/bfde158d5d1322c0c2df398a8d1ccce04943be2e
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d58d71c2167601762351962b9604808d3be94400
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f35ceec54d48e227fa46f8f97fd100a77b8eab15
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/650981e718e68005ca2760a6358134b8a98ebea4
416baaa9-dc9f-4396-8d5f-8c081fb06d67