Array index error in the (1) ieee80211_ioctl_getwmmparams and (2)
ieee80211_ioctl_setwmmparams functions in net80211/ieee80211_wireless.c in
MadWifi before 0.9.3.1 allows local users to cause a denial of service
(system crash), possibly obtain kernel memory contents, and possibly
execute arbitrary code via a large negative array index value.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 6.06 | noarch | linux-restricted-modules-2.6.15 | < 2.6.15.12-29.1 | UNKNOWN |
ubuntu | 6.10 | noarch | linux-restricted-modules-2.6.17 | < 2.6.17.8-12.3 | UNKNOWN |
ubuntu | 7.04 | noarch | linux-restricted-modules-2.6.20 | < 2.6.20.5-16.29 | UNKNOWN |