Bug 2150960 (CVE-2022-3628)

Summary:	CVE-2022-3628 kernel: USB-accessible buffer overflow in brcmfmac
Product:	[Other] Security Response	Reporter:	Alex <allarkin>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bhu, bskeggs, chwhite, crwood, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hdegoede, hkrzesin, hpa, jarod, jarodwilson, jburrell, jfaracco, jferlan, jforbes, jglisse, jlelli, joe.lawrence, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lleshchi, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rogbas, rvrbovsk, scweaver, steved, tyberry, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Linux kernel 6.1-rc5	Doc Type:	If docs needed, set a value
Doc Text:	A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-16 22:31:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2150961, 2150962, 2150963, 2150964, 2150965
Bug Blocks:	2133533

Description Alex 2022-12-05 17:37:35 UTC

A flaw array-index-out-of-bounds in the Linux Kernel found in drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c. When attaching malicious USB device, buffer overflow could happen in the Broadcom Full MAC Wi-Fi driver. The bug occurs in brcmf_fweh_event_worker, when emsg.bsscfgidx, data from an URB provided by a USB device, is bigger than the size of the array drvr->iflist.

References:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c?id=6788ba8aed4e28e90f72d68a9d794e34eac17295
https://seclists.org/oss-sec/2022/q4/60

Comment 1 Alex 2022-12-05 17:38:10 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2150961]

Comment 5 Justin M. Forbes 2022-12-08 15:43:44 UTC

This was fixed for Fedora with the 6.0.8 stable kernel updates.

Comment 8 errata-xmlrpc 2023-05-09 07:12:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2148 https://access.redhat.com/errata/RHSA-2023:2148

Comment 9 errata-xmlrpc 2023-05-09 07:51:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2458 https://access.redhat.com/errata/RHSA-2023:2458

Comment 10 errata-xmlrpc 2023-05-16 08:05:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2736 https://access.redhat.com/errata/RHSA-2023:2736

Comment 11 errata-xmlrpc 2023-05-16 08:34:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2951 https://access.redhat.com/errata/RHSA-2023:2951

Comment 12 Product Security DevOps Team 2023-05-16 22:31:32 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-3628

Comment 15 errata-xmlrpc 2024-01-24 16:42:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0412 https://access.redhat.com/errata/RHSA-2024:0412