)]}'
{
  "commit": "de124365a7d2deed22cf706583930f28d537ff0f",
  "tree": "9e6241f396c17547cbd03fefafaf263843de7f8a",
  "parents": [
    "7d998f6b7365d50a9905bf57fd28b41c7ebe8e9d"
  ],
  "author": {
    "name": "Johannes Berg",
    "email": "johannes.berg@intel.com",
    "time": "Thu Oct 13 20:16:01 2022 +0200"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Sat Oct 15 07:59:05 2022 +0200"
  },
  "message": "wifi: mac80211: fix MBSSID parsing use-after-free\n\ncommit ff05d4b45dd89b922578dac497dcabf57cf771c6\n\nWhen we parse a multi-BSSID element, we might point some\nelement pointers into the allocated nontransmitted_profile.\nHowever, we free this before returning, causing UAF when the\nrelevant pointers in the parsed elements are accessed.\n\nFix this by not allocating the scratch buffer separately but\nas part of the returned structure instead, that way, there\nare no lifetime issues with it.\n\nThe scratch buffer introduction as part of the returned data\nhere is taken from MLO feature work done by Ilan.\n\nThis fixes CVE-2022-42719.\n\nFixes: 5023b14cf4df (\"mac80211: support profile split between elements\")\nCo-developed-by: Ilan Peer \u003cilan.peer@intel.com\u003e\nSigned-off-by: Ilan Peer \u003cilan.peer@intel.com\u003e\nReviewed-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nCc: Felix Fietkau \u003cnbd@nbd.name\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3633e49239c7864099c19b81b4addc3490abd81c",
      "old_mode": 33188,
      "old_path": "net/mac80211/ieee80211_i.h",
      "new_id": "21549a440b38c1f1169277dc1506d93098a4bd47",
      "new_mode": 33188,
      "new_path": "net/mac80211/ieee80211_i.h"
    },
    {
      "type": "modify",
      "old_id": "2ac61e68b6b48c4f358d078a24268df0e3672270",
      "old_mode": 33188,
      "old_path": "net/mac80211/util.c",
      "new_id": "354badd32793ad1a25ff9a60c0247328a7c97dd1",
      "new_mode": 33188,
      "new_path": "net/mac80211/util.c"
    }
  ]
}