1 From ef566a4d4f74022e1fdb0a2addfe81e6de9f4aae Mon Sep 17 00:00:00 2001
2 From: Jouni Malinen <j@w1.fi>
3 Date: Wed, 29 Apr 2015 02:21:53 +0300
4 Subject: [PATCH] AP WMM: Fix integer underflow in WMM Action frame parser
6 The length of the WMM Action frame was not properly validated and the
7 length of the information elements (int left) could end up being
8 negative. This would result in reading significantly past the stack
9 buffer while parsing the IEs in ieee802_11_parse_elems() and while doing
10 so, resulting in segmentation fault.
12 This can result in an invalid frame being used for a denial of service
13 attack (hostapd process killed) against an AP with a driver that uses
14 hostapd for management frame processing (e.g., all mac80211-based
17 Thanks to Kostya Kortchinsky of Google security team for discovering and
20 Signed-off-by: Jouni Malinen <j@w1.fi>
21 Signed-off-by: Baruch Siach <baruch@tkos.co.il>
24 1 file changed, 3 insertions(+)
26 diff --git a/src/ap/wmm.c b/src/ap/wmm.c
27 index 6d4177c2a847..314e244bc956 100644
30 @@ -274,6 +274,9 @@ void hostapd_wmm_action(struct hostapd_data *hapd,
35 + return; /* not a valid WMM Action frame */
37 /* extract the tspec info element */
38 if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) {
39 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,