Description
Array index error in the (1) ieee80211_ioctl_getwmmparams and (2) ieee80211_ioctl_setwmmparams functions in net80211/ieee80211_wireless.c in MadWifi before 0.9.3.1 allows local users to cause a denial of service (system crash), possibly obtain kernel memory contents, and possibly execute arbitrary code via a large negative array index value.
References
- USN-479-1 vendor-advisory
- GLSA-200706-04 vendor-advisory
- 25339 third-party-advisory
- 24114 vdb-entry
- 26083 third-party-advisory
- 25622 third-party-advisory
- SUSE-SR:2007:014 vendor-advisory
- http://madwifi.org/ticket/1334
- 25763 third-party-advisory
- MDKSA-2007:132 vendor-advisory
- http://madwifi.org/wiki/Security
- 36637 vdb-entry
- 25861 third-party-advisory
- madwifi-ieee80211ioctlgetwmmparams-dos(34453) vdb-entry
- ADV-2007-1919 vdb-entry
- 20070606 FLEA-2007-0021-2: madwifi mailing-list