CVE-2007-2831 Array index error in the (1) ieee80211_ioctl_getwmmparams and (2) ieee80211_ioctl_setwmmparams functions in net80211/ieee80211_wireless.c in MadWifi before 0.9.3.1 allows local users to cause a denial...
HighCVSS 10.0
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Array index error in the (1) ieee80211_ioctl_getwmmparams and (2) ieee80211_ioctl_setwmmparams functions in net80211/ieee80211_wireless.c in MadWifi before 0.9.3.1 allows local users to cause a denial of service (system crash), possibly obtain kernel memory contents, and possibly execute arbitrary code via a large negative array index value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| madwifi | <= 0.9.3 | No fix listed |
| madwifi | = 0.9.0 | No fix listed |
| madwifi | = 0.9.1 | No fix listed |
| madwifi | = 0.9.2 | No fix listed |
| madwifi | = 0.9.2.1 | No fix listed |
References
- madwifi.org patch
- madwifi.org patch
- 36637 vdb-entry
- 25339 third-party-advisory vendor-advisory
- 25622 third-party-advisory vendor-advisory
- 25763 third-party-advisory vendor-advisory
- 25861 third-party-advisory vendor-advisory
- 26083 third-party-advisory vendor-advisory
- GLSA-200706-04 vendor-advisory
- MDKSA-2007:132 vendor-advisory
- SUSE-SR:2007:014 vendor-advisory
- 20070606 FLEA-2007-0021-2: madwifi mailing-list
- 24114 vdb-entry
- USN-479-1 vendor-advisory
- ADV-2007-1919 vdb-entry
- madwifi-ieee80211ioctlgetwmmparams-dos(34453) vdb-entry