Bug#729573: linux-image-3.2.0-4-amd64: [ath9k_htc] MAC address not properly updated

To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Bug#729573: linux-image-3.2.0-4-amd64: [ath9k_htc] MAC address not properly updated
From: Mathy Vanhoef <mathy.vanhoef@cs.kuleuven.be>
Date: Thu, 14 Nov 2013 14:41:32 +0100
Message-id: <[🔎] 5284D30C.2080402@cs.kuleuven.be>
Reply-to: Mathy Vanhoef <mathy.vanhoef@cs.kuleuven.be>, 729573@bugs.debian.org

Package: src:linux
Version: 3.2.51-1
Severity: normal
Tags: security upstream

Dear Maintainer,

I found a bug in the ath9k_htc driver for Atheros WiFi dongles. When auser changes their MAC address, an attacker can retrieve the originalMAC address, which is a potential privacy risk. Details of the bug:http://www.mathyvanhoef.com/2013/11/unmasking-spoofed-mac-address.html

The ath9k driver does not appear to have this problem, there thehardware MAC address is set to one of the virtual interfaces.


Can a CVE ID be assigned to this?

- Mathy

-- Package-specific info:
** Version:

Linux version 3.2.0-4-amd64 (debian-kernel@lists.debian.org) (gccversion 4.6.3 (Debian 4.6.3-14) ) #1 SMP Debian 3.2.51-1


** Command line:

BOOT_IMAGE=/boot/vmlinuz-3.2.0-4-amd64root=UUID=ec9bcec8-9663-49d7-8a25-bf613e6c3c4a ro quiet


** Not tainted

** Kernel log:

[ 1.690401] ata2.00: ATAPI: VMware Virtual IDE CDROM Drive, 00000001,max UDMA/33

[    1.706387] ata2.00: configured for UDMA/33

[ 1.706719] scsi 2:0:0:0: CD-ROM NECVMWar VMware IDE CDR101.00 PQ: 0 ANSI: 5[ 1.707630] sd 0:0:0:0: [sda] 41943040 512-byte logical blocks: (21.4GB/20.0 GiB)

[    1.707658] sd 0:0:0:0: [sda] Write Protect is off
[    1.707659] sd 0:0:0:0: [sda] Mode Sense: 61 00 00 00
[    1.707736] sd 0:0:0:0: [sda] Cache data unavailable
[    1.707737] sd 0:0:0:0: [sda] Assuming drive cache: write through
[    1.708163] sd 0:0:0:0: [sda] Cache data unavailable
[    1.708165] sd 0:0:0:0: [sda] Assuming drive cache: write through
[    1.763687]  sda: sda1 sda2 < sda5 >
[    1.764079] sd 0:0:0:0: [sda] Cache data unavailable
[    1.764081] sd 0:0:0:0: [sda] Assuming drive cache: write through
[    1.764143] sd 0:0:0:0: [sda] Attached SCSI disk
[    1.768841] sd 0:0:0:0: Attached scsi generic sg0 type 0
[    1.769024] sr 2:0:0:0: Attached scsi generic sg1 type 5

[ 1.770644] sr0: scsi3-mmc drive: 1x/1x writer dvd-ram cd/rw xa/form2cdda tray

[    1.770646] cdrom: Uniform CD-ROM driver Revision: 3.20
[    1.770839] sr 2:0:0:0: Attached scsi CD-ROM sr0
[    2.062746] PM: Starting manual resume from disk
[    2.062749] PM: Hibernation image partition 8:5 present
[    2.062750] PM: Looking for hibernation image.
[    2.062865] PM: Image not found (code -22)
[    2.062866] PM: Hibernation image not present or could not be loaded.

[ 2.138374] EXT4-fs (sda1): mounted filesystem with ordered datamode. Opts: (null)

[    2.380252] usb 2-1: New USB device found, idVendor=0e0f, idProduct=0003

[ 2.380254] usb 2-1: New USB device strings: Mfr=1, Product=2,SerialNumber=0

[    2.380256] usb 2-1: Product: VMware Virtual USB Mouse
[    2.380257] usb 2-1: Manufacturer: VMware
[    2.498204] usb 2-2: new full-speed USB device number 3 using uhci_hcd
[    2.637230] usb 2-2: New USB device found, idVendor=0e0f, idProduct=0002

[ 2.637233] usb 2-2: New USB device strings: Mfr=0, Product=1,SerialNumber=0

[    2.637235] usb 2-2: Product: VMware Virtual USB Hub
[    2.646260] hub 2-2:1.0: USB hub found
[    2.648232] hub 2-2:1.0: 7 ports detected
[    6.623959] udevd[312]: starting version 175
[    7.585123] input: PC Speaker as /devices/platform/pcspkr/input/input1
[    7.645465] alg: No test for __gcm-aes-aesni (__driver-gcm-aes-aesni)

[ 7.689535] input: Power Button as/devices/LNXSYSTM:00/LNXPWRBN:00/input/input2

[    7.693365] ACPI: Power Button [PWRF]

[ 7.823874] input: ImPS/2 Generic Wheel Mouse as/devices/platform/i8042/serio1/input/input3

[    7.864211] ACPI: AC Adapter [ACAD] (on-line)
[    8.115027] shpchp: Standard Hot Plug PCI Controller Driver version: 0.4
[    8.571089] piix4_smbus 0000:00:07.3: Host SMBus controller not enabled!
[    8.729820] Error: Driver 'pcspkr' is already registered, aborting...
[    8.998965] parport_pc 00:09: reported by Plug and Play ACPI
[    8.999127] parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE]
[    9.057874] [drm] Initialized drm 1.1.0 20060810
[    9.202569] [drm] Capabilities:
[    9.202571] [drm]   Rect copy.
[    9.202572] [drm]   Cursor.
[    9.202573] [drm]   Cursor bypass.
[    9.202573] [drm]   Cursor bypass 2.
[    9.202574] [drm]   8bit emulation.
[    9.202575] [drm]   Alpha cursor.
[    9.202576] [drm]   Extended Fifo.
[    9.202576] [drm]   Multimon.
[    9.202577] [drm]   Pitchlock.
[    9.202578] [drm]   Irq mask.
[    9.202578] [drm]   Display Topology.
[    9.202579] [drm]   GMR.
[    9.202580] [drm]   Traces.
[    9.202580] [drm]   GMR2.
[    9.202581] [drm]   Screen Object 2.
[    9.202582] [drm] Max GMR ids is 64
[    9.202583] [drm] Max GMR descriptors is 4096
[    9.202583] [drm] Max number of GMR pages is 196608
[    9.202584] [drm] Max dedicated hypervisor surface memory is 786432 kiB
[    9.202586] [drm] VRAM at 0xe8000000 size is 32768 kiB
[    9.202587] [drm] MMIO at 0xfe000000 size is 2048 kiB
[    9.202588] [drm] global init.
[    9.202638] [TTM] Zone  kernel: Available graphics memory: 250882 kiB
[    9.202639] [TTM] Initializing pool allocator
[    9.202643] [TTM] Initializing DMA pool allocator
[    9.202843] [drm] width 640
[    9.202852] [drm] height 480
[    9.202860] [drm] bpp 32
[    9.207791] [drm] Fifo max 0x00200000 min 0x00001000 cap 0x0000077f
[    9.208468] [drm] Supports vblank timestamp caching Rev 1 (10.10.2010).
[    9.208470] [drm] No driver support for vblank timestamp query.
[    9.208526] [drm] Screen objects system initialized
[    9.208528] [drm] Detected no device 3D availability.

[ 9.220871] [drm] Initialized vmwgfx 2.4.0 20120209 for 0000:00:0f.0on minor 0[ 9.475301] input: VMware VMware Virtual USB Mouse as/devices/pci0000:00/0000:00:11.0/0000:02:00.0/usb2/2-1/2-1:1.0/input/input4[ 9.475471] generic-usb 0003:0E0F:0003.0001: input,hidraw0: USB HIDv1.10 Mouse [VMware VMware Virtual USB Mouse] on usb-0000:02:00.0-1/input0

[    9.475486] usbcore: registered new interface driver usbhid
[    9.475487] usbhid: USB HID core driver

[ 11.622159] Adding 901116k swap on /dev/sda5. Priority:-1 extents:1across:901116k

[   11.633283] EXT4-fs (sda1): re-mounted. Opts: (null)
[   12.156165] EXT4-fs (sda1): re-mounted. Opts: errors=remount-ro
[   12.462035] loop: module loaded

[ 15.328763] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, FlowControl: None

[   15.688726] RPC: Registered named UNIX socket transport module.
[   15.688729] RPC: Registered udp transport module.
[   15.688730] RPC: Registered tcp transport module.
[   15.688731] RPC: Registered tcp NFSv4.1 backchannel transport module.
[   15.774752] FS-Cache: Loaded
[   15.946824] FS-Cache: Netfs 'nfs' registered for caching
[   16.053619] Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
[   26.230363] eth0: no IPv6 routers present

** Model information
sys_vendor: VMware, Inc.
product_name: VMware Virtual Platform
product_version: None
chassis_vendor: No Enclosure
chassis_version: N/A
bios_vendor: Phoenix Technologies LTD
bios_version: 6.00
board_vendor: Intel Corporation
board_name: 440BX Desktop Reference Platform
board_version: None

** Loaded modules:
nfsd
nfs
nfs_acl
auth_rpcgss
fscache
lockd
sunrpc
loop
snd_ens1371
vmwgfx
snd_ac97_codec
snd_rawmidi
snd_seq_device
ttm
drm
parport_pc
snd_pcm
i2c_piix4
usbhid
hid
parport
snd_page_alloc
snd_timer
vmw_balloon
shpchp
coretemp
i2c_core
ac
power_supply
processor
thermal_sys
crc32c_intel
container
button
ghash_clmulni_intel
aesni_intel
snd
psmouse
ac97_bus
soundcore
evdev
serio_raw
pcspkr
gameport
aes_x86_64
aes_generic
cryptd
ext4
crc16
jbd2
mbcache
sr_mod
cdrom
sg
ata_generic
sd_mod
crc_t10dif
floppy
uhci_hcd
ehci_hcd
ata_piix
libata
e1000
usbcore
usb_common
mptspi
scsi_transport_spi
mptscsih
mptbase
scsi_mod

** PCI devices:

00:00.0 Host bridge [0600]: Intel Corporation 440BX/ZX/DX -82443BX/ZX/DX Host bridge [8086:7190] (rev 01)

    Subsystem: VMware Virtual Machine Chipset [15ad:1976]

Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-Stepping- SERR- FastB2B- DisINTx-Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort-<TAbort- <MAbort- >SERR- <PERR- INTx-

    Latency: 0
    Kernel driver in use: agpgart-intel

00:01.0 PCI bridge [0604]: Intel Corporation 440BX/ZX/DX - 82443BX/ZX/DXAGP bridge [8086:7191] (rev 01) (prog-if 00 [Normal decode])Control: I/O+ Mem+ BusMaster+ SpecCycle+ MemWINV+ VGASnoop- ParErr-Stepping- SERR+ FastB2B- DisINTx-Status: Cap- 66MHz+ UDF- FastB2B- ParErr- DEVSEL=medium >TAbort-<TAbort- <MAbort- >SERR- <PERR- INTx-

    Latency: 0
    Bus: primary=00, secondary=01, subordinate=01, sec-latency=64

Secondary status: 66MHz+ FastB2B+ ParErr- DEVSEL=medium >TAbort-<TAbort- <MAbort- <SERR- <PERR-

    BridgeCtl: Parity- SERR- NoISA+ VGA- MAbort- >Reset- FastB2B-
        PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-

00:07.0 ISA bridge [0601]: Intel Corporation 82371AB/EB/MB PIIX4 ISA[8086:7110] (rev 08)

    Subsystem: VMware Virtual Machine Chipset [15ad:1976]

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-Stepping- SERR- FastB2B- DisINTx-Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort-<TAbort- <MAbort- >SERR- <PERR- INTx-

    Latency: 0

00:07.1 IDE interface [0101]: Intel Corporation 82371AB/EB/MB PIIX4 IDE[8086:7111] (rev 01) (prog-if 8a [Master SecP PriP])

    Subsystem: VMware Virtual Machine Chipset [15ad:1976]

Control: I/O+ Mem- BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-Stepping- SERR- FastB2B- DisINTx-Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort-<TAbort- <MAbort- >SERR- <PERR- INTx-

    Latency: 64

Region 0: [virtual] Memory at 000001f0 (32-bit, non-prefetchable)[size=8]Region 1: [virtual] Memory at 000003f0 (type 3, non-prefetchable)[size=1]Region 2: [virtual] Memory at 00000170 (32-bit, non-prefetchable)[size=8]Region 3: [virtual] Memory at 00000370 (type 3, non-prefetchable)[size=1]

    Region 4: I/O ports at 1060 [size=16]
    Kernel driver in use: ata_piix

00:07.3 Bridge [0680]: Intel Corporation 82371AB/EB/MB PIIX4 ACPI[8086:7113] (rev 08)

    Subsystem: VMware Virtual Machine Chipset [15ad:1976]

Control: I/O+ Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr-Stepping- SERR- FastB2B- DisINTx-Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort-<TAbort- <MAbort- >SERR- <PERR- INTx-

    Interrupt: pin ? routed to IRQ 9

00:07.7 System peripheral [0880]: VMware Virtual Machine CommunicationInterface [15ad:0740] (rev 10)

    Subsystem: VMware Virtual Machine Communication Interface [15ad:0740]

Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr-Stepping- SERR- FastB2B- DisINTx-Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort-<TAbort- <MAbort- >SERR- <PERR- INTx-

    Interrupt: pin A routed to IRQ 9
    Region 0: I/O ports at 1080 [size=64]
    Region 1: Memory at febfe000 (64-bit, non-prefetchable) [size=8K]
    Capabilities: <access denied>

00:0f.0 VGA compatible controller [0300]: VMware SVGA II Adapter[15ad:0405] (prog-if 00 [VGA controller])

    Subsystem: VMware SVGA II Adapter [15ad:0405]

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-Stepping- SERR- FastB2B- DisINTx-Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort-<TAbort- <MAbort- >SERR- <PERR- INTx-

    Latency: 64, Cache Line Size: 32 bytes
    Interrupt: pin A routed to IRQ 16
    Region 0: I/O ports at 1070 [size=16]
    Region 1: Memory at e8000000 (32-bit, prefetchable) [size=128M]
    Region 2: Memory at fe000000 (32-bit, non-prefetchable) [size=8M]
    [virtual] Expansion ROM at 20000000 [disabled] [size=32K]
    Capabilities: <access denied>
    Kernel driver in use: vmwgfx

00:10.0 SCSI storage controller [0100]: LSI Logic / Symbios Logic53c1030 PCI-X Fusion-MPT Dual Ultra320 SCSI [1000:0030] (rev 01)

    Subsystem: VMware LSI Logic Parallel SCSI Controller [15ad:1976]

    Latency: 64 (1500ns min, 63750ns max)
    Interrupt: pin A routed to IRQ 17
    Region 0: I/O ports at 1400 [size=256]
    Region 1: Memory at feba0000 (64-bit, non-prefetchable) [size=128K]
    Region 3: Memory at febc0000 (64-bit, non-prefetchable) [size=128K]
    [virtual] Expansion ROM at 20008000 [disabled] [size=16K]
    Kernel driver in use: mptspi

00:11.0 PCI bridge [0604]: VMware PCI bridge [15ad:0790] (rev 02)(prog-if 01 [Subtractive decode])Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-Stepping- SERR- FastB2B- DisINTx-Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort-<TAbort- <MAbort- >SERR- <PERR- INTx-

    Latency: 64, Cache Line Size: 32 bytes
    Bus: primary=00, secondary=02, subordinate=02, sec-latency=68
    I/O behind bridge: 00002000-00003fff
    Memory behind bridge: fd500000-fdffffff
    Prefetchable memory behind bridge: 00000000e7b00000-00000000e7ffffff

Secondary status: 66MHz- FastB2B+ ParErr- DEVSEL=medium >TAbort-<TAbort- <MAbort- <SERR- <PERR-

    BridgeCtl: Parity- SERR- NoISA+ VGA- MAbort- >Reset- FastB2B-
        PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
    Capabilities: <access denied>

00:15.0 PCI bridge [0604]: VMware PCI Express Root Port [15ad:07a0] (rev01) (prog-if 00 [Normal decode])Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-Stepping- SERR- FastB2B- DisINTx-Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort-<TAbort- <MAbort- >SERR- <PERR- INTx-

    Latency: 0, Cache Line Size: 32 bytes
    Bus: primary=00, secondary=03, subordinate=03, sec-latency=0
    I/O behind bridge: 00004000-00004fff
    Memory behind bridge: fd400000-fd4fffff
    Prefetchable memory behind bridge: 00000000e7a00000-00000000e7afffff