Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can progressively guess the physical MAC address of an
ath9k device which is configured to hide this address.

Impacted products: Linux

Severity: 1/4

Creation date: 09/01/2014

DESCRIPTION OF THE VULNERABILITY

The ath9k_htc driver is used by Atheros WiFi devices.

It implements VIF (Multiple Virtual Interface), so it can listen
on several MAC addresses. An administrator can thus choose to mask
its real MAC address. However, the logic used to decide to reply
to a packet is invalid. Indeed, the driver accepts to reply to the
"testedmac" address if "(physicalmac & virtualmac) == (testedmac &
virtualmac)".

An attacker can therefore progressively guess the physical MAC
address of an ath9k device which is configured to hide this
address.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Linux-kernel-information-disclosure-via-ath9k-14044