In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: regulatory: improve invalid hints checking Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into useralpha2[] via regulatoryhintuser() call. Such invalid regulatory hints should be rejected. While a sanity check from commit 47caf685a685 ("cfg80211: regulatory: reject invalid hints") looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons. 1) The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a country/domain. For instance, greek letters will also be considered upper/lower letters and for such characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin characters. 2) While processing a user regulatory request, between regprocesshintuser() and regulatoryhintuser() there happens to be a call to queueregulatoryrequest() which modifies letters in request->alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters from the second part of ctype[]. Syzbot triggers a warning in isuserregdomsaved() by first sending over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing isalpha() check. Prevent this by enhancing isanalpha2() to ensure that incoming symbols are latin letters and nothing else. [1] Syzbot report: ------------[ cut here ]------------ Unexpected user alpha2: A? WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 isuserregdomsaved net/wireless/reg.c:440 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restorealpha2 net/wireless/reg.c:3424 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restoreregulatorysettings+0x3c0/0x1e50 net/wireless/reg.c:3516 Modules linked in: CPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: eventspowerefficient crdatimeoutwork RIP: 0010:isuserregdomsaved net/wireless/reg.c:440 [inline] RIP: 0010:restorealpha2 net/wireless/reg.c:3424 [inline] RIP: 0010:restoreregulatorysettings+0x3c0/0x1e50 net/wireless/reg.c:3516 ... Call Trace: <TASK> crdatimeoutwork+0x27/0x50 net/wireless/reg.c:542 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xa65/0x1850 kernel/workqueue.c:3310 workerthread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 retfromfork+0x4d/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "7.6.0+6.14.0-10.10", "binary_name": "bpftool" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-bpf-dev" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-buildinfo-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-buildinfo-6.14.0-10-generic-64k" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-cloud-tools-6.14.0-10" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-cloud-tools-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-cloud-tools-common" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-doc" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-headers-6.14.0-10" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-headers-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-headers-6.14.0-10-generic-64k" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-image-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-image-6.14.0-10-generic-dbgsym" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-image-unsigned-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-image-unsigned-6.14.0-10-generic-64k" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-image-unsigned-6.14.0-10-generic-64k-dbgsym" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-image-unsigned-6.14.0-10-generic-dbgsym" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-lib-rust-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-libc-dev" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-modules-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-modules-6.14.0-10-generic-64k" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-modules-extra-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-modules-ipu6-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-modules-ipu7-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-modules-iwlwifi-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-modules-usbio-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-modules-vision-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-perf" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-source-6.14.0" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-tools-6.14.0-10" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-tools-6.14.0-10-generic" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-tools-6.14.0-10-generic-64k" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-tools-common" }, { "binary_version": "6.14.0-10.10", "binary_name": "linux-tools-host" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1004.4", "binary_name": "linux-aws-cloud-tools-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-aws-headers-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-aws-tools-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-buildinfo-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-cloud-tools-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-headers-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-unsigned-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-unsigned-6.14.0-1004-aws-dbgsym" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-extra-6.14.0-1004-aws" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-tools-6.14.0-1004-aws" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1003.3", "binary_name": "linux-azure-cloud-tools-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-azure-headers-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-azure-tools-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-buildinfo-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-cloud-tools-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-headers-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-azure-dbgsym" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-extra-6.14.0-1003-azure" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-tools-6.14.0-1003-azure" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1003.3", "binary_name": "linux-buildinfo-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-buildinfo-6.14.0-1003-gcp-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-gcp-headers-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-gcp-tools-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-headers-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-headers-6.14.0-1003-gcp-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-gcp-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-gcp-64k-dbgsym" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-gcp-dbgsym" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-6.14.0-1003-gcp-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-extra-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-extra-6.14.0-1003-gcp-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-tools-6.14.0-1003-gcp" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-tools-6.14.0-1003-gcp-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1003.3", "binary_name": "linux-buildinfo-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-buildinfo-6.14.0-1003-oracle-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-headers-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-headers-6.14.0-1003-oracle-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-oracle-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-oracle-64k-dbgsym" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-image-unsigned-6.14.0-1003-oracle-dbgsym" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-6.14.0-1003-oracle-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-extra-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-modules-extra-6.14.0-1003-oracle-64k" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-oracle-headers-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-oracle-tools-6.14.0-1003" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-tools-6.14.0-1003-oracle" }, { "binary_version": "6.14.0-1003.3", "binary_name": "linux-tools-6.14.0-1003-oracle-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1004.4", "binary_name": "linux-buildinfo-6.14.0-1004-raspi" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-headers-6.14.0-1004-raspi" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-6.14.0-1004-raspi" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-6.14.0-1004-raspi-dbgsym" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-6.14.0-1004-raspi" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-raspi-headers-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-raspi-tools-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-tools-6.14.0-1004-raspi" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-1001.1", "binary_name": "linux-buildinfo-6.14.0-1001-realtime" }, { "binary_version": "6.14.0-1001.1", "binary_name": "linux-cloud-tools-6.14.0-1001-realtime" }, { "binary_version": "6.14.0-1001.1", "binary_name": "linux-headers-6.14.0-1001-realtime" }, { "binary_version": "6.14.0-1001.1", "binary_name": "linux-image-unsigned-6.14.0-1001-realtime" }, { "binary_version": "6.14.0-1001.1", "binary_name": "linux-image-unsigned-6.14.0-1001-realtime-dbgsym" }, { "binary_version": "6.14.0-1001.1", "binary_name": "linux-modules-6.14.0-1001-realtime" }, { "binary_version": "6.14.0-1001.1", "binary_name": "linux-modules-extra-6.14.0-1001-realtime" }, { "binary_version": "6.14.0-1001.1", "binary_name": "linux-modules-iwlwifi-6.14.0-1001-realtime" }, { "binary_version": "6.14.0-1001.1", "binary_name": "linux-realtime-cloud-tools-6.14.0-1001" }, { "binary_version": "6.14.0-1001.1", "binary_name": "linux-realtime-headers-6.14.0-1001" }, { "binary_version": "6.14.0-1001.1", "binary_name": "linux-realtime-tools-6.14.0-1001" }, { "binary_version": "6.14.0-1001.1", "binary_name": "linux-tools-6.14.0-1001-realtime" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.14.0-9.9.1", "binary_name": "linux-buildinfo-6.14.0-9-generic" }, { "binary_version": "6.14.0-9.9.1", "binary_name": "linux-headers-6.14.0-9-generic" }, { "binary_version": "6.14.0-9.9.1", "binary_name": "linux-image-6.14.0-9-generic" }, { "binary_version": "6.14.0-9.9.1", "binary_name": "linux-image-6.14.0-9-generic-dbgsym" }, { "binary_version": "6.14.0-9.9.1", "binary_name": "linux-modules-6.14.0-9-generic" }, { "binary_version": "6.14.0-9.9.1", "binary_name": "linux-riscv-headers-6.14.0-9" }, { "binary_version": "6.14.0-9.9.1", "binary_name": "linux-riscv-tools-6.14.0-9" }, { "binary_version": "6.14.0-9.9.1", "binary_name": "linux-tools-6.14.0-9-generic" } ] }