Received: by 2002:a05:6a10:a0d1:0:0:0:0 with SMTP id j17csp4153335pxa;
        Mon, 10 Aug 2020 02:04:16 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJyKpQxe8vOhEKhsoRQfgcrMxoRPF1GBK+YzMuGZQAanZPKpfOIuF0/Ttze5zAud9rZLUwSw
X-Received: by 2002:a17:906:3ac4:: with SMTP id z4mr19394946ejd.65.1597050256739;
        Mon, 10 Aug 2020 02:04:16 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1597050256; cv=none;
        d=google.com; s=arc-20160816;
        b=YxkO40+RSjL5jSqd+9e0EnZsYV03bXehUJ1C6ilPfMIUIc7Ai6HizSrafYwuoCjwCU
         ELWB4VOWoGrfCbUUCAfmNain/uaJmS3EV6vo5CS5GgdFjMf7xElFqqkSKzaVOFGOyGsv
         Bx7zA6ZpHTk3FCGtdh0tK8aPu4+tQG9YTqeSA1b6r1jLAw5praXIOvaDvw+5oVooOpNW
         n2fFPypgc6lmxct4vj5bMAws6KcIiyHQNB5EwL9MsYMt7xLOWwSa3xVu6AlC7htmHMZn
         GevBc1wbeGODDlENX4Iv7P+LDuEEmGHuGPns2u+0bRqEuAbmGc8EiCGkrT1J3GLyTYOr
         c0pA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=list-id:precedence:sender:user-agent:content-disposition
         :mime-version:message-id:subject:to:from:date:dkim-signature;
        bh=iGz664uJ2hWyo6/xsAJ3SeQmQmS8Fq5niSP2WTDZaY8=;
        b=fU20Ghts9IfqbMjibxd46gkCSKgxv6qvJuorTivTlb+ZDkmPesMs2zasn9sNqmZX/J
         0+jk384LZMpiI54QmJRALmaEypmal3tllyypVPNb49yvcrU6AnwN4I0Xo9SEkfGdyreK
         Gc+YE3qiCwGylcCj5hkk+S0ZzGIMc9+FJtgKWC6wRxD7FRLwj4WM+3zxFU06NIRjyczw
         z6fwM+y84xYryfIyIFImQ2nMwLxtGBc4wNuUqrBO1pIc/wEyh8dhTIYReNDd17OIve1c
         EvhvqiYc+W3i26nXbFnDaWzsw9ZJGV9U28JckWXiQG2tiUibDpgQrIiKrL9CkZs1oLqe
         lQaA==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@kernel.org header.s=default header.b="iTOe/o+t";
       spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org
Return-Path: <linux-wireless-owner@vger.kernel.org>
Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18])
        by mx.google.com with ESMTP id v18si10318514ejb.407.2020.08.10.02.03.53;
        Mon, 10 Aug 2020 02:04:16 -0700 (PDT)
Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@kernel.org header.s=default header.b="iTOe/o+t";
       spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1726700AbgHJJB3 (ORCPT <rfc822;yuvalsteuer11@gmail.com>
        + 99 others); Mon, 10 Aug 2020 05:01:29 -0400
Received: from mail.kernel.org ([198.145.29.99]:49302 "EHLO mail.kernel.org"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1726675AbgHJJB3 (ORCPT <rfc822;linux-wireless@vger.kernel.org>);
        Mon, 10 Aug 2020 05:01:29 -0400
Received: from pali.im (pali.im [31.31.79.79])
        (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
        (No client certificate requested)
        by mail.kernel.org (Postfix) with ESMTPSA id BA762206B5;
        Mon, 10 Aug 2020 09:01:28 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
        s=default; t=1597050088;
        bh=iGz664uJ2hWyo6/xsAJ3SeQmQmS8Fq5niSP2WTDZaY8=;
        h=Date:From:To:Subject:From;
        b=iTOe/o+tUrENJ3DYTSR5GCfRZhSGku2sb26nMXFZQIAeYrcsZkakeOzubEXeJND9z
         H346ID4DQ8Bo7N9sJM2YGPalyoJQMxwsOmelR/iV7m3wTyvLVNbCjyz+T4zZbym7Ua
         U7CbyQos44ofwm1qxknlhxoPU7iHtaTGtOpVxLPw=
Received: by pali.im (Postfix)
        id 635057C9; Mon, 10 Aug 2020 11:01:26 +0200 (CEST)
Date:   Mon, 10 Aug 2020 11:01:26 +0200
From:   Pali =?utf-8?B?Um9ow6Fy?= <pali@kernel.org>
To:     ath10k@lists.infradead.org, ath9k-devel@qca.qualcomm.com,
        linux-wireless@vger.kernel.org, Kalle Valo <kvalo@codeaurora.org>
Subject: CVE-2020-3702: Firmware updates for ath9k and ath10k chips
Message-ID: <20200810090126.mtu3uocpcjg5se5e@pali>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: NeoMutt/20180716
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

Hello!

ESET engineers on their blog published some information about new
security vulnerability CVE-2020-3702 in ath9k wifi cards:
https://www.welivesecurity.com/2020/08/06/beyond-kr00k-even-more-wifi-chips-vulnerable-eavesdropping/

According to Qualcomm security bulletin this CVE-2020-3702 affects also
some Qualcomm IPQ chips which are handled by ath10k driver:
https://www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin#_cve-2020-3702

Kalle, could you or other people from Qualcomm provide updated and fixed
version of ath9k and ath10k firmwares in linux-firmware git repository?

According to Qualcomm security bulletin this issue has Critical security
rating, so I think fixed firmware files should be updated also in stable
releases of linux distributions.