ID

VAR-200712-0597

CVE

CVE-2007-5938

TITLE

Intel iwlwifi of iwl_set_rate() Service disruption in functions (DoS) Vulnerabilities

DESCRIPTION

The iwl_set_rate function in compatible/iwl3945-base.c in iwlwifi 1.1.21 and earlier dereferences an iwl_get_hw_mode return value without checking for NULL, which might allow remote attackers to cause a denial of service (kernel panic) via unspecified vectors during module initialization. The 'iwlwifi' drive is prone to a NULL-pointer dereference vulnerability because of a flaw in the 'compatible/iwl3945-base.c' file. Attackers can exploit this issue to trigger a kernel panic and cause denial-of-service conditions. Versions prior to iwlwifi 1.1.22 are vulnerable. Wireless WiFi Link is a wireless network card used in many notebooks. There is a loophole in the implementation of the Wireless WiFi Link network card driver, and a remote attacker may use this loophole to make the user's system unavailable. The iwl_set_rate() function of the compatible/iwl3945-base.c file in the iwlwifi driver of the Wireless WiFi Link network card has a null pointer reference vulnerability: static void iwl_set_rate(struct iwl_priv *priv) { const struct ieee80211_hw_mode *hw = NULL; struct ieee80211_rate *rate; int i; (1) hw = iwl_get_hw_mode(priv, priv->phymode); <-- not check ret priv->active_rate = 0; priv->active_rate_basic = 0; IWL_DEBUG_RATE("Setting rates for 802.11%c\n" , hw->mode == MODE_IEEE80211A ? 'a' : ((hw->mode == MODE_IEEE80211B) ? 'b' : 'g')); (2) for (i = 0; i < hw->num_rates; i++) { <-- null deref. (1) does not check the return value of iwl_get_hw_mode, if NULL is returned, it will cause (2) to reference a null pointer. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Red Hat update for kernel SECUNIA ADVISORY ID: SA29236 VERIFY ADVISORY: http://secunia.com/advisories/29236/ CRITICAL: Less critical IMPACT: Unknown, Security Bypass, DoS WHERE: Local system OPERATING SYSTEM: Red Hat Enterprise Linux Desktop (v. 5 client) http://secunia.com/product/13653/ Red Hat Enterprise Linux (v. 5 server) http://secunia.com/product/13652/ DESCRIPTION: Red Hat has issued an update for the kernel. This fixes a security issue and some vulnerabilities, where one has an unknown impact and others can be exploited by malicious, local users to bypass certain security restrictions or cause a DoS (Denial of Service). For more information: SA27842 SA27915 SA28696 SOLUTION: Updated packages are available via Red Hat Network. http://rhn.redhat.com ORIGINAL ADVISORY: https://rhn.redhat.com/errata/RHSA-2008-0154.html OTHER REFERENCES: SA27842: http://secunia.com/advisories/27842/ SA27915: http://secunia.com/advisories/27915/ SA28696: http://secunia.com/advisories/28696/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

digital error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Ian Schram ischram@telenet.be

SOURCES

LAST UPDATE DATE

2024-08-14T12:17:44.147000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE