Jouni Malinen

Nome do software vulnerável e versões afetadas: Kernel do Linux (versões afetadas não especificadas) Descrição: O problema está relacionado ao componente cfg80211 do kernel do Linux, onde o bloqueio dos registros de gerenciamento estava com falha. Isso causou corrupção na lista porque a função `cfg80211 mgmt registrations update()` iterava pela lista sem manter todos os spinlocks corretos. O problema foi corrigido movendo o bloqueio para o wiphy/rdev, o que corrige o bug de forma trivial, já que o bloqueio wdev já está mantido. Esta falha poderia permitir que um invasor causasse uma negação de serviço. Recomendações: No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Versões do wpa supplicant anteriores à 2.10 **Descrição** Uma vulnerabilidade no componente p2p/p2p pd.c do wpa supplicant está relacionada a erros na liberação de recursos. A exploração dessa vulnerabilidade poderia permitir que um invasor remoto causasse uma negação de serviço ou, potencialmente, executasse código arbitrário. O invasor deve estar dentro do alcance do sinal de rádio para enviar solicitações de descoberta de provisionamento Wi-Fi Direct especialmente criadas. **Recomendações** Para versões anteriores à 2.10, atualize para a versão 2.10 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso aos recursos do Wi-Fi Direct até que a atualização seja aplicada.

**Name of the Vulnerable Software and Affected Versions** hostapd versions prior to 2.10 wpa supplicant versions prior to 2.10 **Description** The issue is related to a denial of service caused by mishandled source address validation, which should have been prevented by management frame protection. An attacker within the 802.11 communications range can send a crafted 802.11 frame to cause associated stations to be disconnected, requiring a reconnection to the network. This can be achieved by injecting a specially constructed unauthenticated IEEE 802.11 frame to the access point. **Recommendations** For hostapd versions prior to 2.10, update to version 2.10 or later to resolve the issue. For wpa supplicant versions prior to 2.10, update to version 2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the network to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** hostapd versions prior to 2.8 wpa supplicant versions prior to 2.8 **Description** The issue is related to the EAP-pwd implementation, which does not properly validate fragmentation reassembly state. This could lead to process termination due to a NULL pointer dereference, resulting in a denial of service. The affected components are eap server/eap server pwd.c and eap peer/eap pwd.c. **Recommendations** For hostapd versions prior to 2.8, update to version 2.8 or later to resolve the issue. For wpa supplicant versions prior to 2.8, update to version 2.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** FreeRADIUS versions 3.0 through 3.0.8 **Description** The issue in the EAP-PWD module allows remote attackers to have an unspecified impact by sending a crafted commit or confirm message. This triggers an out-of-bounds read. **Recommendations** For FreeRADIUS versions 3.0 through 3.0.8, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** FreeRADIUS versions 3.0 through 3.0.8 **Description** The issue allows remote attackers to cause a denial of service, resulting in a server crash due to a NULL pointer dereference. This can be achieved by sending a zero-length EAP-PWD packet. **Recommendations** For FreeRADIUS versions 3.0 through 3.0.8, update to a version that contains a fix for this issue to prevent remote attackers from causing a denial of service.

**Name of the Vulnerable Software and Affected Versions** FreeRADIUS versions 3.0 through 3.0.8 **Description** The issue is caused by an off-by-one error in the EAP-PWD module, which triggers a buffer overflow. **Recommendations** For FreeRADIUS versions 3.0 through 3.0.8, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** wpa supplicant versions 2.x before 2.6 **Description** The issue is related to the WNM Sleep Mode code in wpa supplicant, which does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated. This allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service. Additionally, there is a Wi-Fi module vulnerability in the Android operating system related to the lack of protection for service data, which can allow an attacker to obtain confidential information about wireless network parameters by accessing the local physical environment. **Recommendations** For wpa supplicant versions 2.x before 2.6, update to version 2.6 or later to resolve the issue. As a temporary workaround, consider disabling the WNM Sleep Mode feature until a patch is available. Restrict access to the Wi-Fi module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** wpa supplicant versions 2.x before 2.6 **Description** The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, by sending an EAP-pwd Confirm message followed by the Identity exchange when EAP-pwd is enabled. This is due to a NULL pointer dereference in the `eap pwd perform confirm exchange` function. **Recommendations** For wpa supplicant versions 2.x before 2.6, update to version 2.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** wpa supplicant versions 2.0 through 2.5 **Description** The issue concerns the `eap pwd process` function in `eap peer/eap pwd.c`, which does not validate the size of the reassembly buffer for the final fragment when EAP-pwd is enabled. This allows remote attackers to cause a denial of service by sending a large final fragment in an EAP-pwd message. **Recommendations** For wpa supplicant versions 2.0 through 2.5, update to version 2.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** hostapd versions 2.0 through 2.5 **Description** The issue is related to the `eap pwd process` function in `eap server/eap server pwd.c`, which does not validate the size of the reassembly buffer for the final fragment in EAP-pwd messages. This can be exploited by remote attackers to cause a denial of service (process termination) by sending a large final fragment in an EAP-pwd message, particularly when used with an internal EAP server or a RADIUS server with EAP-pwd enabled. **Recommendations** For hostapd versions 2.0 through 2.5, update to version 2.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** wpa supplicant versions 1.0 through 2.4 **Description** The issue allows remote attackers to cause a denial of service, read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries. **Recommendations** For wpa supplicant versions 1.0 through 2.4, update to a version that contains a fix for this issue to prevent potential exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 3.13.5 **Description** The issue is related to the ieee80211 fragment function in the Linux kernel, which does not properly maintain a certain tail pointer. This allows remote attackers to obtain sensitive cleartext information by reading packets. **Recommendations** For versions prior to 3.13.5, update to version 3.13.5 or later to resolve the issue.