CVE-2022-50551

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()

This patch fixes a shift-out-of-bounds in brcmfmac that occurs in

BIT(chiprev) when a 'chiprev' provided by the device is too large.

It should also not be equal to or greater than BITS_PER_TYPE(u32)

as we do bitwise AND with a u32 variable and BIT(chiprev). The patch

adds a check that makes the function return NULL if that is the case.

Note that the NULL case is later handled by the bus-specific caller,

brcmf_usb_probe_cb() or brcmf_usb_reset_resume(), for example.

Found by a modified version of syzkaller.

UBSAN: shift-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c

shift exponent 151055786 is too large for 64-bit type 'long unsigned int'

CPU: 0 PID: 1885 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References