Linux内核CVE-2020-14386：nl80211颜色变化检查竞态漏洞修复

漏洞概述 漏洞编号: CVE-2020-14386 漏洞描述: 在调用驱动时，如果链接正在变为无效，可能会导致颜色变化检查失败。 提交者: Johannes Berg 提交日期: 2020-04-14 14:50:48 +0200 影响范围 受影响组件: Linux内核中的无线驱动（特别是涉及颜色变化检查的部分） 具体文件: 修复方案 修复方法: 在调用驱动之前，验证链接是否正在变为无效。 相关补丁: - 补丁链接: https://patchwork.kernel.org/patch/11538666/ - 补丁文件: POC代码或利用代码 ```c diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 75727390ad6df..3076046237bc 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -18388,6 +18388,10 @@ static int nl80211_color_change(struct sk_buff skb, struct genl_info info) { struct wiphy wiphy = wiphy_dev_to_wiphy(info->user_ptr); struct cfg80211_chan_def chandef = info->attrs[NL80211_ATTR_CHANDF]; u32 color = info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset = info->attrs[NL80211_ATTR_BEACON_OFFSET]; u32 beacon_duration = info->attrs[NL80211_ATTR_BEACON_DURATION]; u32 beacon_interval = info->attrs[NL80211_ATTR_BEACON_INTERVAL]; u32 beacon_timeout = info->attrs[NL80211_ATTR_BEACON_TIMEOUT]; u32 beacon_count = info->attrs[NL80211_ATTR_BEACON_COUNT]; u32 beacon_offset

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Linux内核CVE-2020-14386：nl80211颜色变化检查竞态漏洞修复

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Linux内核CVE-2020-14386：nl80211颜色变化检查竞态漏洞修复

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！