Felix Fietkau

تم تحديد ثغرة أمنية تتمثل في إشارة خاطئة إلى مؤشر NULL في الروتين mt7915 mac fill rx vector الخاص ببرنامج التشغيل mt76 في نواة لينكس. تحدث هذه المشكلة عندما لا تدعم الشريحة dbdc وتبلغ الأجهزة أن band idx محدد بقيمة 1.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue concerns the Linux kernel's handling of TCP fragmentation. Specifically, it involves the `net: gso: fix tcp fraglist segmentation after pull from frag list` fix, which addresses a problem where optional datapath hooks like NAT and BPF can modify SKB GSO FRAGLIST skbs, breaking their invariants. This can lead to a NULL pointer dereference in ` tcpv4 gso segment list csum` at `tcp hdr(seg->next)`. The solution involves detecting invalid geometry due to pull by checking the `head skb` size and converting it to be able to pass to regular `skb segment` instead of `skb segment list`. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the incorrect handling of errors in the Linux kernel's core component, specifically with the `skb copy` and `skb copy expand` functions when dealing with `SKB GSO FRAGLIST` skbs. These skbs must not be linearized, as this would make them invalid and potentially lead to a crash when `skb gso segment` is called later. The vulnerability can be exploited to cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a use-after-free vulnerability in the `free irq()` function of the MediaTek MT7925E (PCIe) driver in the Linux kernel. This vulnerability can be exploited to cause a denial of service. The `mt7925 pci remove()` function in the `drivers/net/wireless/mediatek/mt76/mt7925/pci.c` module is also affected by the reuse of previously freed memory. To address this issue, a flag `MT76 REMOVED` is applied to indicate that the device was removed, preventing further resource access. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a race condition in the mac80211 component of the Linux kernel. This condition can lead to potential crashes due to uninitialized drv priv data when fast-xmit is enabled before the sta has been uploaded to the driver. The vulnerability may allow an attacker to elevate privileges in the system. The affected functions include ieee80211 check fast xmit() in net/mac80211/tx.c and sta info insert finish() in net/mac80211/sta info.c.

توجد حالة تنافسية من نوع «use-after-free» في نواة لينكس، وتحديدًا في الوحدة النمطية mt76، تتعلق بحالة tx عند إزالة المحطة. هناك نافذة زمنية قصيرة يمكن خلالها أن تؤدي نشاطات «tx» الجارية إلى إضافة skb إلى idr لتتبع الحالة بعد مسحه، مما يبقي wcid مرتبطًا بقائمة استطلاع الحالة. تحدث هذه المشكلة بسبب توقيت إعادة تعيين مؤشر wcid إلى الصفر في dev->wcid أثناء تنفيذ mt76 sta pre rcu remove.

The issue is related to the `mt76 dma tx queue skb raw` function in the Linux kernel's mt76 component. It involves a potential DMA mapping leak due to the `buf` being uninitialized, which could cause its `skip unmap` field to inherit a non-zero value from stack garbage. This may lead to DMA mappings for MCU command frames not being unmapped after completion, potentially allowing an attacker to gain unauthorized access to protected information.