The iwl_set_rate function in compatible/iwl3945-base.c in iwlwifi 1.1.21 and earlier dereferences an iwl_get_hw_mode return value without checking for NULL, which might allow remote attackers to cause a denial of service (kernel panic) via unspecified vectors during module initialization.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pro_wireless_3945abg | Intel | 1.1.21 (including) | 1.1.21 (including) |
| Wireless_wifi_link_4965agn | Intel | 1.1.21 (including) | 1.1.21 (including) |
| Red Hat Enterprise Linux 5 | RedHat | kernel-0:2.6.18-53.1.14.el5 | * |
| Linux | Ubuntu | upstream | * |
| Linux-source-2.6.15 | Ubuntu | upstream | * |
| Linux-source-2.6.17 | Ubuntu | upstream | * |
| Linux-source-2.6.20 | Ubuntu | upstream | * |
| Linux-source-2.6.22 | Ubuntu | upstream | * |