Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Sender: kvalo=codeaurora.org@mg.codeaurora.org
DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org AF0EAC433F1
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [PATCH 5.13] mt76: validate rx A-MSDU subframes
From:   Kalle Valo <kvalo@codeaurora.org>
In-Reply-To: <20210513070303.20253-1-nbd@nbd.name>
References: <20210513070303.20253-1-nbd@nbd.name>
To:     Felix Fietkau <nbd@nbd.name>
Cc:     linux-wireless@vger.kernel.org
User-Agent: pwcli/0.1.0-git (https://github.com/kvalo/pwcli/) Python/3.5.2
Message-Id: <20210515114814.6599FC4338A@smtp.codeaurora.org>
Date:   Sat, 15 May 2021 11:48:14 +0000 (UTC)
Precedence: bulk

Felix Fietkau <nbd@nbd.name> wrote:

> Mitigate A-MSDU injection attacks (CVE-2020-24588) by detecting if the
> destination address of a subframe equals an RFC1042 (i.e., LLC/SNAP)
> header, and if so dropping the complete A-MSDU frame. This mitigates
> known attacks, although new (unknown) aggregation-based attacks may
> remain possible.
> 
> This defense works because in A-MSDU aggregation injection attacks, a
> normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means
> the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042
> header. In other words, the destination MAC address of the first A-MSDU
> subframe contains the start of an RFC1042 header during an aggregation
> attack. We can detect this and thereby prevent this specific attack.
> For details, see Section 7.2 of "Fragment and Forge: Breaking Wi-Fi
> Through Frame Aggregation and Fragmentation".
> 
> Signed-off-by: Felix Fietkau <nbd@nbd.name>

Patch applied to wireless-drivers.git, thanks.

2c2bdd2372af mt76: validate rx A-MSDU subframes

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20210513070303.20253-1-nbd@nbd.name/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches