wifi: mac80211_hwsim: drop short frames (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.15 % · centile 4 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Modified
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: drop short frames While technically some control frames like ACK are shorter and end after Address 1, such frames shouldn't be forwarded through wmediumd or similar userspace, so require the full 3-address header to avoid accessing invalid memory if shorter frames are passed in.
Références
- https://git.kernel.org/stable/c/3beb97bed860d95b14ad23578ce8ddaea62023db
- https://git.kernel.org/stable/c/672205c6f2d11978fcd7f0f336bb2c708e28874b
- https://git.kernel.org/stable/c/c64ee9dd335832d5e2ab0a8fc83a34ad4c729799
- https://git.kernel.org/stable/c/b9a175e3b250b0dc6e152988040aa5014e98e61e
- https://git.kernel.org/stable/c/89a41ed7f21476301659ebd25ccb48a60791c1a7
- https://git.kernel.org/stable/c/fba360a047d5eeeb9d4b7c3a9b1c8308980ce9a6
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | Linux |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2023-59940
- GCVE · GCVE-0-2023-53321
Avis du CERT-FR
- CERTFR-2026-AVI-0195 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1032 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1009 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0921 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0895 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*< 5.4.257cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.197cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.133cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.55cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.5.5
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 05d610af3e71a782fa28a1351b687da982d208ee < 3beb97bed860d95b14ad23578ce8ddaea62023db ; affected 05d610af3e71a782fa28a1351b687da982d208ee < 672205c6f2d11978fcd7f0f336bb2c708e28874b ; affected 05d610af3e71a782fa28a1351b687da982d208ee < c64ee9dd335832d5e2ab0a8fc83a34ad4c729799 ; affected 05d610af3e71a782fa28a1351b687da982d208ee < b9a175e3b250b0dc6e152988040aa5014e98e61e ; affected 05d610af3e71a782fa28a1351b687da982d208ee < 89a41ed7f21476301659ebd25ccb48a60791c1a7 ; affected 05d610af3e71a782fa28a1351b687da982d208ee < fba360a047d5eeeb9d4b7c3a9b1c8308980ce9a6 |
| Linux · Linux | affected 5.4 ; unaffected 0 < 5.4 ; unaffected 5.4.257 ≤ 5.4.* ; unaffected 5.10.197 ≤ 5.10.* ; unaffected 5.15.133 ≤ 5.15.* ; unaffected 6.1.55 ≤ 6.1.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |