summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/key-replay-cve-multiple3.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/key-replay-cve-multiple3.patch')
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/key-replay-cve-multiple3.patch201
1 files changed, 201 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/key-replay-cve-multiple3.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/key-replay-cve-multiple3.patch
new file mode 100644
index 0000000000..2e22655851
--- /dev/null
+++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/key-replay-cve-multiple3.patch
@@ -0,0 +1,201 @@
1The WPA2 four-way handshake protocol is vulnerable to replay attacks which can
2result in unauthenticated clients gaining access to the network.
3
4Backport a number of patches from upstream to fix this.
5
6CVE: CVE-2017-13077
7CVE: CVE-2017-13078
8CVE: CVE-2017-13079
9CVE: CVE-2017-13080
10CVE: CVE-2017-13081
11CVE: CVE-2017-13082
12CVE: CVE-2017-13086
13CVE: CVE-2017-13087
14CVE: CVE-2017-13088
15
16Upstream-Status: Backport
17Signed-off-by: Ross Burton <ross.burton@intel.com>
18
19From 8280294e74846ea342389a0cd17215050fa5afe8 Mon Sep 17 00:00:00 2001
20From: Jouni Malinen <j@w1.fi>
21Date: Sun, 1 Oct 2017 12:12:24 +0300
22Subject: [PATCH 3/8] Extend protection of GTK/IGTK reinstallation of WNM-Sleep
23 Mode cases
24
25This extends the protection to track last configured GTK/IGTK value
26separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a
27corner case where these two different mechanisms may get used when the
28GTK/IGTK has changed and tracking a single value is not sufficient to
29detect a possible key reconfiguration.
30
31Signed-off-by: Jouni Malinen <j@w1.fi>
32---
33 src/rsn_supp/wpa.c | 53 +++++++++++++++++++++++++++++++++++++---------------
34 src/rsn_supp/wpa_i.h | 2 ++
35 2 files changed, 40 insertions(+), 15 deletions(-)
36
37diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
38index 95bd7be..7a2c68d 100644
39--- a/src/rsn_supp/wpa.c
40+++ b/src/rsn_supp/wpa.c
41@@ -709,14 +709,17 @@ struct wpa_gtk_data {
42
43 static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
44 const struct wpa_gtk_data *gd,
45- const u8 *key_rsc)
46+ const u8 *key_rsc, int wnm_sleep)
47 {
48 const u8 *_gtk = gd->gtk;
49 u8 gtk_buf[32];
50
51 /* Detect possible key reinstallation */
52- if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
53- os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
54+ if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
55+ os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
56+ (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
57+ os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
58+ sm->gtk_wnm_sleep.gtk_len) == 0)) {
59 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
60 "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
61 gd->keyidx, gd->tx, gd->gtk_len);
62@@ -757,8 +760,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
63 }
64 os_memset(gtk_buf, 0, sizeof(gtk_buf));
65
66- sm->gtk.gtk_len = gd->gtk_len;
67- os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
68+ if (wnm_sleep) {
69+ sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
70+ os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
71+ sm->gtk_wnm_sleep.gtk_len);
72+ } else {
73+ sm->gtk.gtk_len = gd->gtk_len;
74+ os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
75+ }
76
77 return 0;
78 }
79@@ -852,7 +861,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
80 (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
81 gtk_len, gtk_len,
82 &gd.key_rsc_len, &gd.alg) ||
83- wpa_supplicant_install_gtk(sm, &gd, key_rsc))) {
84+ wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
85 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
86 "RSN: Failed to install GTK");
87 os_memset(&gd, 0, sizeof(gd));
88@@ -868,14 +877,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
89
90 #ifdef CONFIG_IEEE80211W
91 static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
92- const struct wpa_igtk_kde *igtk)
93+ const struct wpa_igtk_kde *igtk,
94+ int wnm_sleep)
95 {
96 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
97 u16 keyidx = WPA_GET_LE16(igtk->keyid);
98
99 /* Detect possible key reinstallation */
100- if (sm->igtk.igtk_len == len &&
101- os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
102+ if ((sm->igtk.igtk_len == len &&
103+ os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
104+ (sm->igtk_wnm_sleep.igtk_len == len &&
105+ os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
106+ sm->igtk_wnm_sleep.igtk_len) == 0)) {
107 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
108 "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
109 keyidx);
110@@ -900,8 +913,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
111 return -1;
112 }
113
114- sm->igtk.igtk_len = len;
115- os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
116+ if (wnm_sleep) {
117+ sm->igtk_wnm_sleep.igtk_len = len;
118+ os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
119+ sm->igtk_wnm_sleep.igtk_len);
120+ } else {
121+ sm->igtk.igtk_len = len;
122+ os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
123+ }
124
125 return 0;
126 }
127@@ -924,7 +943,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm,
128 return -1;
129
130 igtk = (const struct wpa_igtk_kde *) ie->igtk;
131- if (wpa_supplicant_install_igtk(sm, igtk) < 0)
132+ if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
133 return -1;
134 }
135
136@@ -1574,7 +1593,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
137 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
138 key_rsc = null_rsc;
139
140- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) ||
141+ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
142 wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
143 goto failed;
144 os_memset(&gd, 0, sizeof(gd));
145@@ -2386,8 +2405,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
146 sm->tptk_set = 0;
147 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
148 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
149+ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
150 #ifdef CONFIG_IEEE80211W
151 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
152+ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
153 #endif /* CONFIG_IEEE80211W */
154 }
155
156@@ -2920,8 +2941,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
157 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
158 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
159 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
160+ os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
161 #ifdef CONFIG_IEEE80211W
162 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
163+ os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
164 #endif /* CONFIG_IEEE80211W */
165 #ifdef CONFIG_IEEE80211R
166 os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
167@@ -2986,7 +3009,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
168
169 wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
170 gd.gtk, gd.gtk_len);
171- if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) {
172+ if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
173 os_memset(&gd, 0, sizeof(gd));
174 wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
175 "WNM mode");
176@@ -2998,7 +3021,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
177 const struct wpa_igtk_kde *igtk;
178
179 igtk = (const struct wpa_igtk_kde *) (buf + 2);
180- if (wpa_supplicant_install_igtk(sm, igtk) < 0)
181+ if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
182 return -1;
183 #endif /* CONFIG_IEEE80211W */
184 } else {
185diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h
186index afc9e37..9a54631 100644
187--- a/src/rsn_supp/wpa_i.h
188+++ b/src/rsn_supp/wpa_i.h
189@@ -32,8 +32,10 @@ struct wpa_sm {
190 int rx_replay_counter_set;
191 u8 request_counter[WPA_REPLAY_COUNTER_LEN];
192 struct wpa_gtk gtk;
193+ struct wpa_gtk gtk_wnm_sleep;
194 #ifdef CONFIG_IEEE80211W
195 struct wpa_igtk igtk;
196+ struct wpa_igtk igtk_wnm_sleep;
197 #endif /* CONFIG_IEEE80211W */
198
199 struct eapol_sm *eapol; /* EAPOL state machine from upper level code */
200--
2012.7.4 \ No newline at end of file
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-04-27 21:54:49 +0000