CVE-2024-27053 wifi: wilc1000: fix RCU usage in connect path

2024-05-0112:54:45

Linux

github.com

linux kernel

wilc1000

fix rcu usage

connect function

cfg802.11 layer

lockdep enabled

atmel sama5

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.2%

JSON

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: fix RCU usage in connect path

With lockdep enabled, calls to the connect function from cfg802.11 layer
lead to the following warning:

=============================
WARNING: suspicious RCU usage
6.7.0-rc1-wt+ #333 Not tainted

drivers/net/wireless/microchip/wilc1000/hif.c:386
suspicious rcu_dereference_check() usage!
[…]
stack backtrace:
CPU: 0 PID: 100 Comm: wpa_supplicant Not tainted 6.7.0-rc1-wt+ #333
Hardware name: Atmel SAMA5
unwind_backtrace from show_stack+0x18/0x1c
show_stack from dump_stack_lvl+0x34/0x48
dump_stack_lvl from wilc_parse_join_bss_param+0x7dc/0x7f4
wilc_parse_join_bss_param from connect+0x2c4/0x648
connect from cfg80211_connect+0x30c/0xb74
cfg80211_connect from nl80211_connect+0x860/0xa94
nl80211_connect from genl_rcv_msg+0x3fc/0x59c
genl_rcv_msg from netlink_rcv_skb+0xd0/0x1f8
netlink_rcv_skb from genl_rcv+0x2c/0x3c
genl_rcv from netlink_unicast+0x3b0/0x550
netlink_unicast from netlink_sendmsg+0x368/0x688
netlink_sendmsg from ____sys_sendmsg+0x190/0x430
____sys_sendmsg from ___sys_sendmsg+0x110/0x158
___sys_sendmsg from sys_sendmsg+0xe8/0x150
sys_sendmsg from ret_fast_syscall+0x0/0x1c

This warning is emitted because in the connect path, when trying to parse
target BSS parameters, we dereference a RCU pointer whithout being in RCU
critical section.
Fix RCU dereference usage by moving it to a RCU read critical section. To
avoid wrapping the whole wilc_parse_join_bss_param under the critical
section, just use the critical section to copy ies data

CNA Affected

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "c460495ee072",
        "lessThan": "e556006de4ea",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c460495ee072",
        "lessThan": "b4bbf38c350a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c460495ee072",
        "lessThan": "d80fc436751c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c460495ee072",
        "lessThan": "745003b5917b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c460495ee072",
        "lessThan": "4bfd20d5f5c6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c460495ee072",
        "lessThan": "5800ec78775c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c460495ee072",
        "lessThan": "dd50d3ead6e3",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c460495ee072",
        "lessThan": "205c50306acf",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/wireless/microchip/wilc1000/hif.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.1"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.1",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "5.4.273",
        "versionType": "custom",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.214",
        "versionType": "custom",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.153",
        "versionType": "custom",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.83",
        "versionType": "custom",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.23",
        "versionType": "custom",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.7.11",
        "versionType": "custom",
        "lessThanOrEqual": "6.7.*"
      },
      {
        "status": "unaffected",
        "version": "6.8.2",
        "versionType": "custom",
        "lessThanOrEqual": "6.8.*"
      },
      {
        "status": "unaffected",
        "version": "6.9",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/wireless/microchip/wilc1000/hif.c"
    ],
    "defaultStatus": "affected"
  }
]