CVE-2022-49740

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads

This patch fixes slab-out-of-bounds reads in brcmfmac that occur in

brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count

value of channel specifications provided by the device is greater than

the length of 'list->element[]', decided by the size of the 'list'

allocated with kzalloc(). The patch adds checks that make the functions

free the buffer and return -EINVAL if that is the case. Note that the

negative return is handled by the caller, brcmf_setup_wiphybands() or

brcmf_cfg80211_attach().

Found by a modified version of syzkaller.

Crash Report from brcmf_construct_chaninfo():

==================================================================

BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430

Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896

CPU: 0 PID: 1896 Comm: kworker/0:2 Tain

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References