wifi: brcmfmac: fix P2P action frame handling without device vif
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.114, 6.18.57, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P action frame handling without device vif Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary interface, or when action-frame abort runs after the P2P device vif has not been created. Fall back to the primary vif when aborting an action frame without a P2P device vif, and guard P2P device saved IE access before using it for peer channel search.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 6eda4e2c54255cd26a58d2fcec73ec3bff7a515b · fixed in 66b89c6a7da47efb38a9b839c2ae221b23a1c88b; From 6eda4e2c54255cd26a58d2fcec73ec3bff7a515b · fixed in 6641ba636bf675b2634c49fe818931cf6ca8f547; From 6eda4e2c54255cd26a58d2fcec73ec3bff7a515b · fixed in f334b26b884dff5d0a558dc464fa55f300868a68; From 6eda4e2c54255cd26a58d2fcec73ec3bff7a515b · fixed in f26e1b16904555e171292e183c3cfc1c38159fc5; From 6eda4e2c54255cd26a58d2fcec73ec3bff7a515b · fixed in 1b1edb9ebed49099bdc924cef49a9aea8b552199
- Linux Linux
3.9
- KernelLinux
From 3.9.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.6