[Pkg-utopia-maintainers] Bug#1051119: NM reports fake Wi-Fi BSSIDs

[Marco d'Itri]

Package: network-manager
Version: 1.44.0-1
Severity: important

"nmcli device wifi list" reports obviously fake BSSIDs for all networks 
to which I have not connected to:

IN-USE  BSSID              SSID                MODE   CHAN  RATE       SIGNAL  >
        B4:4B:D6:..:..:..  (omitted)           Infra  2     65 Mbit/s  87      >
        00:01:02:00:03:90  (omitted)           Infra  2     65 Mbit/s  77      >
        00:01:02:00:03:91  WOW FI - FASTWEB    Infra  2     65 Mbit/s  77      >
        00:01:02:00:03:FD  (omitted)           Infra  2     65 Mbit/s  75      >
*       B4:4B:D6:..:..:..  (omitted)           Infra  36    65 Mbit/s  59      >
        00:01:02:00:03:B3  (omitted)      461  Infra  2     65 Mbit/s  57      >
        00:01:02:00:03:8E  FRITZ!Box 7530 WB   Infra  2     65 Mbit/s  55      >
        82:8F:34:..:..:..  Vodafone-WiFi       Infra  3     65 Mbit/s  54      >
        00:01:02:00:03:93  TIM-29740309        Infra  2     65 Mbit/s  35      >
        00:01:02:00:03:96  (omitted)      045  Infra  2     65 Mbit/s  30      >
        00:01:02:00:04:AE  Sala da pranzo.v,   Infra  2     65 Mbit/s  27      >
        00:01:02:00:04:71  (omitted)           Infra  2     65 Mbit/s  25      >
        00:01:02:00:04:BC  (omitted)           Infra  2     65 Mbit/s  25      >
        00:01:02:00:04:A1  (omitted)           Infra  2     65 Mbit/s  20      >

(The real BSSIDs and the non-generic SSIDs have been elided for 
paranoia reasons.)

This breaks the Mozilla Location Services API (used, among others, by 
Firefox and Geoclue), which once it sees at least two of these 
00:01:02:00:03:* BSSIDs it will happily geolocate me either in Vietnam 
or (less frequently) in Germany.

I do not believe this to be a kernel issue because "iwlist scanning" 
properly reports the BSSIDs of all networks.


-- System Information:
Debian Release: trixie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.4.0-2-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=it_IT.utf8, LC_CTYPE=it_IT.utf8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages network-manager depends on:
ii  adduser                         3.137
ii  dbus [default-dbus-system-bus]  1.14.10-1
ii  dbus-broker [dbus-system-bus]   33-1
ii  libaudit1                       1:3.1.1-1
ii  libbluetooth3                   5.69-1
ii  libc6                           2.37-7
ii  libcurl3-gnutls                 8.2.1-2
ii  libglib2.0-0                    2.77.2-1
ii  libgnutls30                     3.8.1-4
ii  libjansson4                     2.14-2
ii  libmm-glib0                     1.20.6-2
ii  libndp0                         1.8-1
ii  libnewt0.52                     0.52.23-1+b1
ii  libnm0                          1.44.0-1
ii  libpsl5                         0.21.2-1
ii  libreadline8                    8.2-1.3
ii  libselinux1                     3.5-1
ii  libsystemd0                     254.1-3
ii  libteamdctl0                    1.31-1
ii  libudev1                        254.1-3
ii  policykit-1                     123-1
ii  polkitd                         123-1
ii  udev                            254.1-3

Versions of packages network-manager recommends:
ii  dnsmasq-base [dnsmasq-base]  2.89-1
ii  libpam-systemd               254.1-3
pn  modemmanager                 <none>
ii  ppp                          2.4.9-1+1.1+b1
ii  wireless-regdb               2022.06.06-1
ii  wpasupplicant                2:2.10-15

Versions of packages network-manager suggests:
ii  iptables       1.8.9-2
pn  libteam-utils  <none>

Versions of packages network-manager is related to:
ii  isc-dhcp-client  4.4.3-P1-2

-- Configuration Files:
/etc/NetworkManager/NetworkManager.conf changed [not included]
/etc/NetworkManager/dispatcher.d/01-ifupdown changed [not included]

-- no debconf information

-- 
ciao,
Marco
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-utopia-maintainers/attachments/20230903/51736573/attachment-0001.sig>