Vulnerability: Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.
Vulnerability ID: CVE-2011-2517
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2012-05-24
File: net/wireless/nl80211.c
Commit message: nl80211: fix check for valid SSID size in scan operations

In both trigger_scan and sched_scan operations, we were checking for
the SSID length before assigning the value correctly.  Since the
memory was just kzalloc'ed, the check was always failing and SSID with
over 32 characters were allowed to go through.

This was causing a buffer overflow when copying the actual SSID to the
proper place.

This bug has been there since 2.6.29-rc4.

Cc: stable@kernel.org
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Commit author: Luciano Coelho

Vulnerable version (before fix):
 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 	i = 0; 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) { 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 			if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) { 				err = -EINVAL; 				goto out_free; 			} 			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 			request->ssids[i].ssid_len = nla_len(attr); 			i++; 		} 	} static int nl80211_start_sched_scan(struct sk_buff *skb, 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) { 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], 				    tmp) { 			if (request->ssids[i].ssid_len > 			    IEEE80211_MAX_SSID_LEN) { 				err = -EINVAL; 				goto out_free; 			} 			memcpy(request->ssids[i].ssid, nla_data(attr), 			       nla_len(attr)); 			request->ssids[i].ssid_len = nla_len(attr); 			i++; 		} 	}

Fixed version (after fix):
 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 	i = 0; 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) { 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 			request->ssids[i].ssid_len = nla_len(attr); 			if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) { 				err = -EINVAL; 				goto out_free; 			} 			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 			i++; 		} 	} static int nl80211_start_sched_scan(struct sk_buff *skb, 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) { 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], 				    tmp) { 			request->ssids[i].ssid_len = nla_len(attr); 			if (request->ssids[i].ssid_len > 			    IEEE80211_MAX_SSID_LEN) { 				err = -EINVAL; 				goto out_free; 			} 			memcpy(request->ssids[i].ssid, nla_data(attr), 			       nla_len(attr)); 			i++; 		} 	}

Patch:
patch: @@ -3406,12 +3406,12 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 	i = 0;
 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
+			request->ssids[i].ssid_len = nla_len(attr);
 			if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
 				err = -EINVAL;
 				goto out_free;
 			}
 			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
-			request->ssids[i].ssid_len = nla_len(attr);
 			i++;
 		}
 	}
@@ -3572,14 +3572,14 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
 				    tmp) {
+			request->ssids[i].ssid_len = nla_len(attr);
 			if (request->ssids[i].ssid_len >
 			    IEEE80211_MAX_SSID_LEN) {
 				err = -EINVAL;
 				goto out_free;
 			}
 			memcpy(request->ssids[i].ssid, nla_data(attr),
 			       nla_len(attr));
-			request->ssids[i].ssid_len = nla_len(attr);
 			i++;
 		}
 	}
path: net/wireless/nl80211.c