diff options
| author | Daehyeon Ko <4ncienth@gmail.com> | 2026-09-09 15:11:24 +0900 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-09-14 14:48:20 +0200 |
| commit | 06f42accaf3c6aecab1dcc57f68dde6c06c8b380 (patch) | |
| tree | 77cfa00adf757525a957407ac972a8219ab2e997 /tools/perf/scripts/python | |
| parent | e5c8d7acd31b27057ea42cd405d0b3ece097bc89 (diff) | |
| download | linux-06f42accaf3c6aecab1dcc57f68dde6c06c8b380.tar.gz linux-06f42accaf3c6aecab1dcc57f68dde6c06c8b380.zip | |
wifi: libipw: reject TKIP frames without a full MIC
libipw_michael_mic_verify() assumes that an skb contains an eight-byte
Michael MIC. A short TKIP frame makes the unsigned payload length wrap,
causing michael_mic() to read past the skb.
Check that the MIC is present before verifying it, and use the existing
MICHAEL_MIC_LEN constant for all MIC lengths in the verifier.
Fixes: b453872c35cf ("[NET] ieee80211 subsystem")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20260909061124.3802517-1-4ncienth@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions