CVE-2022-49533

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ath11k: Change max no of active probe SSID and BSSID to fw capability

The maximum number of SSIDs in a for active probe requests is currently

reported as 16 (WLAN_SCAN_PARAMS_MAX_SSID) when registering the driver.

The scan_req_params structure only has the capacity to hold 10 SSIDs.

This leads to a buffer overflow which can be triggered from

wpa_supplicant in userspace. When copying the SSIDs into the

scan_req_params structure in the ath11k_mac_op_hw_scan route, it can

overwrite the extraie pointer.

Firmware supports 16 ssid * 4 bssid, for each ssid 4 bssid combo probe

request will be sent, so totally 64 probe requests supported. So

set both max ssid and bssid to 16 and 4 respectively. Remove the

redundant macros of ssid and bssid.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01300-QCAHKSWPL_SILICONZ-1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References