Linux Kernel cfg80211 Multi-BSSID Profile Handling Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Linux kernel's cfg80211 wireless configuration subsystem. The issue arises in the 'cfg80211_merge_profile()' function, which processes Multi-BSSID profiles that are split across multiple elements. The vulnerability occurs because the function's loop does not properly advance its element pointers, causing it to repeatedly process the same data. This flaw can be exploited by sending specially crafted malicious beacons, leading the kernel to spend excessive time handling each one—potentially up to 2 milliseconds per beacon. This unnecessary processing time could be abused to degrade system performance.

Impact

Exploitation of this vulnerability can lead to significant degradation of system performance, as the kernel may waste valuable processing time on each malicious beacon received.

Reproduction

The vulnerability can be reproduced by sending crafted beacon frames that exploit the cfg80211_merge_profile() function's failure to advance its element pointers. This can be done using tools that allow for the creation and transmission of custom Wi-Fi beacon frames, such as Scapy or similar network manipulation frameworks.

Remediation

Users can upgrade to the patched version of the Linux kernel available in the official Linux Kernel Git Repository.