ieee80211_input.c in MadWifi before 0.9.3 does not properly process Channel Switch Announcement Information Elements (CSA IEs), which allows remote attackers to cause a denial of service (loss of communication) via a Channel Switch Count less than or equal to one, triggering a channel change.
- http://www.novell.com/linux/security/advisories/2007_14_sr.html
No PoCs found on GitHub currently.