Kees Cook e0e29b683d b43: stop format string leaking into error msgs ...

The module parameter "fwpostfix" is userspace controllable, unfiltered,
and is used to define the firmware filename. b43_do_request_fw() populates
ctx->errors[] on error, containing the firmware filename. b43err()
parses its arguments as a format string. For systems with b43 hardware,
this could lead to a uid-0 to ring-0 escalation.

CVE-2013-2852

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>

2013-06-12 10:20:59 -04:00

..

ath

ath9k: Use minstrel rate control by default

2013-06-12 10:20:58 -04:00

b43

b43: stop format string leaking into error msgs

2013-06-12 10:20:59 -04:00

b43legacy

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

2013-04-24 10:54:20 -04:00

brcm80211

brcmfmac: Disable powersave mode for P2P link.

2013-05-28 13:43:10 -04:00

hostap

wireless: single_open() leaks

2013-05-05 00:13:20 -04:00

ipw2x00

ipw2x00: move to kstrto* functions

2013-04-10 14:10:34 -04:00

iwlegacy

net: wireless: iwlegacy: fix build error for il_pm_ops

2013-06-12 10:20:57 -04:00

iwlwifi

iwlwifi: dvm: fix zero LQ CMD sending avoidance

2013-05-27 11:33:57 +02:00

libertas

drivers/net: use module_pcmcia_driver() in pcmcia drivers

2013-03-15 12:27:33 -07:00

libertas_tf

mac80211: Use a cfg80211_chan_def in ieee80211_hw_conf_chan

2013-03-25 19:19:35 +01:00

mwifiex

mwifiex: debugfs: Fix out of bounds array access

2013-06-12 10:20:55 -04:00

orinoco

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2013-05-01 14:08:52 -07:00

p54

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

2013-04-24 10:54:20 -04:00

prism54

wireless: Remove unnecessary alloc/OOM messages, alloc cleanups

2013-02-04 13:22:34 -05:00

rt2x00

rt2x00: Use more current logging styles, shrink object size

2013-04-22 15:20:26 -04:00

rtl818x

mac80211: Use a cfg80211_chan_def in ieee80211_hw_conf_chan

2013-03-25 19:19:35 +01:00

rtlwifi

rtlwifi: Fix a false leak indication for PCI devices

2013-06-12 10:20:57 -04:00

ti

wl12xx/wl18xx: scan all 5ghz channels

2013-06-12 10:20:57 -04:00

zd1211rw

mac80211: Use a cfg80211_chan_def in ieee80211_hw_conf_chan

2013-03-25 19:19:35 +01:00

adm8211.c

mac80211: Use a cfg80211_chan_def in ieee80211_hw_conf_chan

2013-03-25 19:19:35 +01:00

adm8211.h

…

airo_cs.c

drivers/net: use module_pcmcia_driver() in pcmcia drivers

2013-03-15 12:27:33 -07:00

airo.c

airo: Use remove_proc_subtree()

2013-05-01 17:29:42 -04:00

airo.h

…

at76c50x-usb.c

mac80211: Use a cfg80211_chan_def in ieee80211_hw_conf_chan

2013-03-25 19:19:35 +01:00

at76c50x-usb.h

…

atmel_cs.c

drivers/net: use module_pcmcia_driver() in pcmcia drivers

2013-03-15 12:27:33 -07:00

atmel_pci.c

atmel: remove __dev* attributes

2012-12-06 15:04:56 -05:00

atmel.c

atmel: printing bogus information

2013-05-22 14:51:11 -04:00

atmel.h

…

Kconfig

drivers/net/wireless: remove depends on CONFIG_EXPERIMENTAL

2013-01-22 12:01:35 -08:00

mac80211_hwsim.c

mac80211_hwsim: correctly register the platform driver

2013-05-16 22:38:02 +02:00

mac80211_hwsim.h

…

Makefile

wireless: fix Atheros drivers compilation

2012-12-17 15:48:43 -05:00

mwl8k.c

mwl8k: remove nonstandard rate 72 Mbps

2013-04-22 15:06:44 -04:00

ray_cs.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-05-01 17:51:54 -07:00

ray_cs.h

…

rayctl.h

…

rndis_wlan.c

rndis_wlan: update email address

2013-03-08 15:58:54 -05:00

wl3501_cs.c

drivers/net: use module_pcmcia_driver() in pcmcia drivers

2013-03-15 12:27:33 -07:00

wl3501.h

…

zd1201.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

zd1201.h

…