Linux Kernel mac80211 Antenna Index Injection Vulnerability

A vulnerability in the Linux kernel's mac80211 wireless subsystem allows for out-of-bounds bit shifting when parsing the radiotap header of injected frames. The issue arises in the 'ieee80211_parse_tx_radiotap' function, where an 8-bit value from userspace is used as a shift count. This can lead to undefined behavior, as the shift exponent can exceed the limits of a 64-bit unsigned long, causing a shift-out-of-bounds error. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability causes a shift-out-of-bounds error, which can lead to undefined behavior in the kernel.

Reproduction

To reproduce this vulnerability, inject a frame with a radiotap header that includes an antenna index value greater than 1. This can be done using tools that allow for packet injection, such as 'scapy' or 'aircrack-ng'. The injected frame should be sent through a network interface that supports 802.11 packet injection. When the frame is processed, the 'ieee80211_parse_tx_radiotap' function will attempt to shift the 'info->control.antennas' bitmap using the injected antenna index. If the index is 2 or higher, it will cause a shift-out-of-bounds condition, which is reported by the Undefined Behavior Sanitizer (UBSAN) as an error.

Remediation

Users can upgrade to the latest version of the Linux kernel, where this vulnerability has been fixed. Instructions for upgrading the kernel can be found in the official Linux kernel documentation.