summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch45
1 files changed, 45 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch
new file mode 100644
index 0000000000..882674fe5b
--- /dev/null
+++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch
@@ -0,0 +1,45 @@
1Upstream-Status: Backport
2
3Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com>
4
5From ef566a4d4f74022e1fdb0a2addfe81e6de9f4aae Mon Sep 17 00:00:00 2001
6From: Jouni Malinen <j@w1.fi>
7Date: Wed, 29 Apr 2015 02:21:53 +0300
8Subject: [PATCH] AP WMM: Fix integer underflow in WMM Action frame parser
9
10The length of the WMM Action frame was not properly validated and the
11length of the information elements (int left) could end up being
12negative. This would result in reading significantly past the stack
13buffer while parsing the IEs in ieee802_11_parse_elems() and while doing
14so, resulting in segmentation fault.
15
16This can result in an invalid frame being used for a denial of service
17attack (hostapd process killed) against an AP with a driver that uses
18hostapd for management frame processing (e.g., all mac80211-based
19drivers).
20
21Thanks to Kostya Kortchinsky of Google security team for discovering and
22reporting this issue.
23
24Signed-off-by: Jouni Malinen <j@w1.fi>
25---
26 src/ap/wmm.c | 3 +++
27 1 file changed, 3 insertions(+)
28
29diff --git a/src/ap/wmm.c b/src/ap/wmm.c
30index 6d4177c..314e244 100644
31--- a/src/ap/wmm.c
32+++ b/src/ap/wmm.c
33@@ -274,6 +274,9 @@ void hostapd_wmm_action(struct hostapd_data *hapd,
34 return;
35 }
36
37+ if (left < 0)
38+ return; /* not a valid WMM Action frame */
39+
40 /* extract the tspec info element */
41 if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) {
42 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
43--
441.9.1
45