Kalle Valo

A kernel panic issue has been resolved in the Linux kernel. The problem occurred during the unload and load of ath11k modules, causing a kernel panic due to an internal error. The issue was related to the `napi by id` function and the `netif napi add` function. The error was triggered when the `ath11k ahb config irq` function was called, leading to a crash. The issue was identified on a Generic DT based system with a CPU PID of 4435.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue is related to an array out-of-bounds access in the SoC stats of the ath12k wifi driver. The `ath12k soc dp stats::hal reo error` array is defined with a maximum size of `DP REO DST RING MAX`. However, the `ath12k dp rx process()` function accesses this array using the REO destination SRNG ring ID, which is incorrect. This leads to out-of-bounds array access. The fix involves modifying the `ath12k dp rx process()` function to use the normal ring ID directly instead of the SRNG ring ID. Recommendations: To resolve the issue, update the Linux kernel to version 6.6.58 or later. As a temporary workaround, consider modifying the `ath12k dp rx process()` function to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access. Restrict access to the vulnerable `ath12k soc dp stats::hal reo error` array to minimize the risk of exploitation.

The issue is related to the wifi: ath11k: fix dfs radar event locking in the Linux kernel. The ath11k active pdevs are protected by RCU, but the DFS radar event handling code calling `ath11k mac get ar by pdev id()` was not marked as a read-side critical section. This could lead to potential use-after-free issues. The code in question has been marked as an RCU read-side critical section to avoid these issues.

An issue in the Linux kernel's WILC1000 wireless driver is related to a heap-based buffer overflow. This occurs due to missing validation of the number of channels when copying the list of operating channels from Wi-Fi management frames. The exploitation of this issue can allow an attacker to execute arbitrary code or cause a denial of service.

The issue is related to the WILC1000 wireless driver in the Linux kernel, where missing validation of `IEEE80211 P2P ATTR CHANNEL LIST` in `drivers/net/wireless/microchip/wilc1000/cfg80211.c` can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames. This can potentially allow an attacker to execute arbitrary code or cause a denial of service.

The issue is related to the WILC1000 wireless driver in the Linux kernel, specifically with the missing validation of `IEEE80211 P2P ATTR OPER CHANNEL` in the `cfg80211.c` file. This can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames, potentially allowing an attacker to execute arbitrary code or cause a denial of service.

An issue in the Linux kernel's WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet, potentially allowing an attacker to cause a denial of service or elevate privileges.

A crash occurs in the ath11k driver during the removal of the `ath11k pci` module when the `amss.bin` file is missing. This is caused by the use of the `mhi async power up()` function, which fails to check for errors. The issue manifests as a null-pointer dereference and a general protection fault within the `ath11k hal srng access begin()` function.

A NULL pointer dereference exists in the `ath11k spectral scan config()` function within the `drivers/net/wireless/ath/ath11k/spectral.c` module of the Linux kernel. This issue occurs when `ath11k` modules are removed using `rmmod` while spectral scan is enabled, leading to a system crash and potential denial of service. The crash is triggered in the `ath11k spectral process data()` function during the spectral deinitialization process.

A buffer overflow issue exists in the Linux kernel, specifically in the ath11k driver. The scan req params structure can hold a maximum of 10 SSIDs, but the driver reports a capacity of 16 SSIDs, leading to a potential buffer overflow when copying SSIDs into the structure. This issue can be triggered from wpa supplicant in userspace. The firmware supports up to 64 probe requests, with 16 SSIDs and 4 BSSIDs each.

The issue is related to a possible array out of bound access in the `mt7921 mcu tx rate report` function. This could potentially lead to security issues. The problem has been resolved by fixing the array out of bound issue and removing an unnecessary variable in the `mt7921 mcu tx rate report` function.