madwifi
Page content
- Author: voroskoi
- Vulnerable: 0.9.3-1terminus1
- Unaffected: 0.9.3.1-1terminus1
Some vulnerabilities have been reported in MadWifi, which can be exploited by malicious, local users and malicious people to cause a DoS (Denial of Service).
- A division by zero error exists within the function “ath_beacon_config()”. This can be exploited to cause a crash by sending a packet with a zero beacon interval to a vulnerable system.
- An input sanitation error exists within the IO control “ieee80211_ioctl_getwmmparams”. This can be exploited to crash the kernel by calling the IO control with a negative index parameter. This may also allow certain parts of the memory to be disclosed.
- An input sanitation error exist within the packet parser when parsing nested 802.3 Ethernet frame lengths. This can be exploited to cause a NULL pointer dereference by sending a specially crafted fast frame packet to a vulnerable system.
- Bug Tracker URL: http://bugs.frugalware.org/task/2078
CVEs:
- There is no CVE for these issues