Linux Kernel iwlwifi Driver TSO Segmentation Vulnerability in MLD Sub-Driver

A vulnerability in the Linux kernel's iwlwifi driver for the MLD sub-driver can lead to a TSO (TCP Segmentation Offload) segmentation issue when AMSDU (Aggregate MAC Service Data Unit) is disabled. This problem arises because the MLD driver sets the maximum AMSDU length to a sentinel value of 1 when AMSDU is disabled for a specific TID (Traffic Identifier). The TSO segmentation function does not check for this sentinel value, allowing the calculation of subframes to reach zero. This zero value propagates through the segmentation process, resulting in the creation of over 32,000 tiny segments from a single GSO (Generic Segmentation Offload) socket buffer. This flood of micro-frames can cause memory corruption and a use-after-free error in TCP's retransmit queue, leading to a null dereference in the TCP RACK (Rapid Acknowledgment) loss detection mechanism.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by flooding the TX (transmit) ring with a large number of tiny segments, creating a burst of TX completion events that can corrupt memory and disrupt TCP's retransmit queue management, according to the CVE description.

Reproduction

To reproduce this vulnerability, disable AMSDU for a specific TID in the iwlwifi MLD driver. This can be done by sending a TLC notification that turns off AMSDU for the desired TID. Once AMSDU is disabled, the driver will set the maximum AMSDU length to 1. When a GSO socket buffer is transmitted, the TSO segmentation function will incorrectly calculate the number of subframes, leading to the creation of an excessive number of tiny segments. This behavior can be observed by monitoring the TX ring for an abnormal increase in micro-frame transmissions and subsequent memory corruption issues.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version of the stable Linux kernel where this issue has been addressed.