Patch "nl80211: check for the required netlink attributes presence" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

nl80211: check for the required netlink attributes presence

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
nl80211-check-for-the-required-netlink-attributes-presence.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Vladis Dronov <[email protected]>
Date: Wed, 13 Sep 2017 00:21:21 +0200
Subject: nl80211: check for the required netlink attributes presence

From: Vladis Dronov <[email protected]>

commit e785fa0a164aa11001cba931367c7f94ffaff888 upstream.

nl80211_set_rekey_data() does not check if the required attributes NL80211_REKEY_DATA_{REPLAY_CTR,KEK,KCK} are present when processing NL80211_CMD_SET_REKEY_OFFLOAD request. This request can be issued by users with CAP_NET_ADMIN privilege and may result in NULL dereference and a system crash. Add a check for the required attributes presence. This patch is based on the patch by bo Zhang.

This fixes CVE-2017-12153.

References: https://bugzilla.redhat.com/show_bug.cgi?id=1491046

---
 net/wireless/nl80211.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -9786,6 +9786,9 @@ static int nl80211_set_rekey_data(struct
 	if (err)
 		return err;
 
+	if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
+	    !tb[NL80211_REKEY_DATA_KCK])
+		return -EINVAL;
 	if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
 		return -ERANGE;
 	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/nl80211-check-for-the-required-netlink-attributes-presence.patch