rpm/wpa_supplicant
SHA256
1
0
Fork 0
forked from pool/wpa_supplicant
Code Pull Requests Activity

Accepting request 641256 from home:kbabioch:branches:hardware

Browse Source 
- Added 0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore
  unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).

OBS-URL: https://build.opensuse.org/request/show/641256
OBS-URL: https://build.opensuse.org/package/show/hardware/wpa_supplicant?expand=0&rev=82
This commit is contained in:
Lars Vogdt 2018-10-11 12:23:42 +00:00 committed by Git OBS Bridge
parent 1ed0220023
commit c78442e92f
3 changed files with 53 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch Normal file
View File

@ -0,0 +1,44 @@
From 3e34cfdff6b192fe337c6fb3f487f73e96582961 Mon Sep 17 00:00:00 2001
From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
Date: Sun, 15 Jul 2018 01:25:53 +0200
Subject: [PATCH] WPA: Ignore unauthenticated encrypted EAPOL-Key data
Ignore unauthenticated encrypted EAPOL-Key data in supplicant
processing. When using WPA2, these are frames that have the Encrypted
flag set, but not the MIC flag.
When using WPA2, EAPOL-Key frames that had the Encrypted flag set but
not the MIC flag, had their data field decrypted without first verifying
the MIC. In case the data field was encrypted using RC4 (i.e., when
negotiating TKIP as the pairwise cipher), this meant that
unauthenticated but decrypted data would then be processed. An adversary
could abuse this as a decryption oracle to recover sensitive information
in the data field of EAPOL-Key messages (e.g., the group key).
(CVE-2018-14526)
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
---
src/rsn_supp/wpa.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff -upr wpa_supplicant-2.6.orig/src/rsn_supp/wpa.c wpa_supplicant-2.6/src/rsn_supp/wpa.c
--- wpa_supplicant-2.6.orig/src/rsn_supp/wpa.c 2016-10-02 21:51:11.000000000 +0300
+++ wpa_supplicant-2.6/src/rsn_supp/wpa.c 2018-08-08 16:55:11.506831029 +0300
@@ -2016,6 +2016,17 @@ int wpa_sm_rx_eapol(struct wpa_sm *sm, c
if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) &&
(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
+ /*
+ * Only decrypt the Key Data field if the frame's authenticity
+ * was verified. When using AES-SIV (FILS), the MIC flag is not
+ * set, so this check should only be performed if mic_len != 0
+ * which is the case in this code branch.
+ */
+ if (!(key_info & WPA_KEY_INFO_MIC)) {
+ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
+ "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data");
+ goto out;
+ }
if (wpa_supplicant_decrypt_key_data(sm, key, ver, key_data,
&key_data_len))
goto out;

6
wpa_supplicant.changes
View File

@ -1,3 +1,9 @@
-------------------------------------------------------------------
Thu Oct 11 11:58:33 UTC 2018 - Karol Babioch <kbabioch@suse.com>
- Added 0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore
unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).
-------------------------------------------------------------------
Fri Sep 21 09:15:34 UTC 2018 - Karol Babioch <kbabioch@suse.com>

4
wpa_supplicant.spec
View File

@ -12,7 +12,7 @@
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
@ -51,6 +51,7 @@ Patch16: rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pen
Patch17: rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
Patch18: wpa_supplicant-bnc-1099835-fix-private-key-password.patch
Patch19: wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch
Patch20: rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
BuildRequires: openssl-devel
BuildRequires: pkgconfig
@ -99,6 +100,7 @@ cp %{SOURCE1} wpa_supplicant/.config
%patch17 -p1
%patch18 -p1
%patch19 -p1
%patch20 -p1
%build
cd wpa_supplicant