diff options
Diffstat (limited to 'meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/key-replay-cve-multiple3.patch')
-rw-r--r-- | meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/key-replay-cve-multiple3.patch | 201 |
1 files changed, 0 insertions, 201 deletions
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/key-replay-cve-multiple3.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/key-replay-cve-multiple3.patch deleted file mode 100644 index 2e22655851..0000000000 --- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/key-replay-cve-multiple3.patch +++ /dev/null | |||
@@ -1,201 +0,0 @@ | |||
1 | The WPA2 four-way handshake protocol is vulnerable to replay attacks which can | ||
2 | result in unauthenticated clients gaining access to the network. | ||
3 | |||
4 | Backport a number of patches from upstream to fix this. | ||
5 | |||
6 | CVE: CVE-2017-13077 | ||
7 | CVE: CVE-2017-13078 | ||
8 | CVE: CVE-2017-13079 | ||
9 | CVE: CVE-2017-13080 | ||
10 | CVE: CVE-2017-13081 | ||
11 | CVE: CVE-2017-13082 | ||
12 | CVE: CVE-2017-13086 | ||
13 | CVE: CVE-2017-13087 | ||
14 | CVE: CVE-2017-13088 | ||
15 | |||
16 | Upstream-Status: Backport | ||
17 | Signed-off-by: Ross Burton <ross.burton@intel.com> | ||
18 | |||
19 | From 8280294e74846ea342389a0cd17215050fa5afe8 Mon Sep 17 00:00:00 2001 | ||
20 | From: Jouni Malinen <j@w1.fi> | ||
21 | Date: Sun, 1 Oct 2017 12:12:24 +0300 | ||
22 | Subject: [PATCH 3/8] Extend protection of GTK/IGTK reinstallation of WNM-Sleep | ||
23 | Mode cases | ||
24 | |||
25 | This extends the protection to track last configured GTK/IGTK value | ||
26 | separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a | ||
27 | corner case where these two different mechanisms may get used when the | ||
28 | GTK/IGTK has changed and tracking a single value is not sufficient to | ||
29 | detect a possible key reconfiguration. | ||
30 | |||
31 | Signed-off-by: Jouni Malinen <j@w1.fi> | ||
32 | --- | ||
33 | src/rsn_supp/wpa.c | 53 +++++++++++++++++++++++++++++++++++++--------------- | ||
34 | src/rsn_supp/wpa_i.h | 2 ++ | ||
35 | 2 files changed, 40 insertions(+), 15 deletions(-) | ||
36 | |||
37 | diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c | ||
38 | index 95bd7be..7a2c68d 100644 | ||
39 | --- a/src/rsn_supp/wpa.c | ||
40 | +++ b/src/rsn_supp/wpa.c | ||
41 | @@ -709,14 +709,17 @@ struct wpa_gtk_data { | ||
42 | |||
43 | static int wpa_supplicant_install_gtk(struct wpa_sm *sm, | ||
44 | const struct wpa_gtk_data *gd, | ||
45 | - const u8 *key_rsc) | ||
46 | + const u8 *key_rsc, int wnm_sleep) | ||
47 | { | ||
48 | const u8 *_gtk = gd->gtk; | ||
49 | u8 gtk_buf[32]; | ||
50 | |||
51 | /* Detect possible key reinstallation */ | ||
52 | - if (sm->gtk.gtk_len == (size_t) gd->gtk_len && | ||
53 | - os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { | ||
54 | + if ((sm->gtk.gtk_len == (size_t) gd->gtk_len && | ||
55 | + os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) || | ||
56 | + (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len && | ||
57 | + os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk, | ||
58 | + sm->gtk_wnm_sleep.gtk_len) == 0)) { | ||
59 | wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, | ||
60 | "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", | ||
61 | gd->keyidx, gd->tx, gd->gtk_len); | ||
62 | @@ -757,8 +760,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, | ||
63 | } | ||
64 | os_memset(gtk_buf, 0, sizeof(gtk_buf)); | ||
65 | |||
66 | - sm->gtk.gtk_len = gd->gtk_len; | ||
67 | - os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); | ||
68 | + if (wnm_sleep) { | ||
69 | + sm->gtk_wnm_sleep.gtk_len = gd->gtk_len; | ||
70 | + os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk, | ||
71 | + sm->gtk_wnm_sleep.gtk_len); | ||
72 | + } else { | ||
73 | + sm->gtk.gtk_len = gd->gtk_len; | ||
74 | + os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); | ||
75 | + } | ||
76 | |||
77 | return 0; | ||
78 | } | ||
79 | @@ -852,7 +861,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, | ||
80 | (wpa_supplicant_check_group_cipher(sm, sm->group_cipher, | ||
81 | gtk_len, gtk_len, | ||
82 | &gd.key_rsc_len, &gd.alg) || | ||
83 | - wpa_supplicant_install_gtk(sm, &gd, key_rsc))) { | ||
84 | + wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) { | ||
85 | wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, | ||
86 | "RSN: Failed to install GTK"); | ||
87 | os_memset(&gd, 0, sizeof(gd)); | ||
88 | @@ -868,14 +877,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, | ||
89 | |||
90 | #ifdef CONFIG_IEEE80211W | ||
91 | static int wpa_supplicant_install_igtk(struct wpa_sm *sm, | ||
92 | - const struct wpa_igtk_kde *igtk) | ||
93 | + const struct wpa_igtk_kde *igtk, | ||
94 | + int wnm_sleep) | ||
95 | { | ||
96 | size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); | ||
97 | u16 keyidx = WPA_GET_LE16(igtk->keyid); | ||
98 | |||
99 | /* Detect possible key reinstallation */ | ||
100 | - if (sm->igtk.igtk_len == len && | ||
101 | - os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { | ||
102 | + if ((sm->igtk.igtk_len == len && | ||
103 | + os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) || | ||
104 | + (sm->igtk_wnm_sleep.igtk_len == len && | ||
105 | + os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk, | ||
106 | + sm->igtk_wnm_sleep.igtk_len) == 0)) { | ||
107 | wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, | ||
108 | "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", | ||
109 | keyidx); | ||
110 | @@ -900,8 +913,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm, | ||
111 | return -1; | ||
112 | } | ||
113 | |||
114 | - sm->igtk.igtk_len = len; | ||
115 | - os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); | ||
116 | + if (wnm_sleep) { | ||
117 | + sm->igtk_wnm_sleep.igtk_len = len; | ||
118 | + os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk, | ||
119 | + sm->igtk_wnm_sleep.igtk_len); | ||
120 | + } else { | ||
121 | + sm->igtk.igtk_len = len; | ||
122 | + os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); | ||
123 | + } | ||
124 | |||
125 | return 0; | ||
126 | } | ||
127 | @@ -924,7 +943,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, | ||
128 | return -1; | ||
129 | |||
130 | igtk = (const struct wpa_igtk_kde *) ie->igtk; | ||
131 | - if (wpa_supplicant_install_igtk(sm, igtk) < 0) | ||
132 | + if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0) | ||
133 | return -1; | ||
134 | } | ||
135 | |||
136 | @@ -1574,7 +1593,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm, | ||
137 | if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc)) | ||
138 | key_rsc = null_rsc; | ||
139 | |||
140 | - if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) || | ||
141 | + if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) || | ||
142 | wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0) | ||
143 | goto failed; | ||
144 | os_memset(&gd, 0, sizeof(gd)); | ||
145 | @@ -2386,8 +2405,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) | ||
146 | sm->tptk_set = 0; | ||
147 | os_memset(&sm->tptk, 0, sizeof(sm->tptk)); | ||
148 | os_memset(&sm->gtk, 0, sizeof(sm->gtk)); | ||
149 | + os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); | ||
150 | #ifdef CONFIG_IEEE80211W | ||
151 | os_memset(&sm->igtk, 0, sizeof(sm->igtk)); | ||
152 | + os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); | ||
153 | #endif /* CONFIG_IEEE80211W */ | ||
154 | } | ||
155 | |||
156 | @@ -2920,8 +2941,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) | ||
157 | os_memset(&sm->ptk, 0, sizeof(sm->ptk)); | ||
158 | os_memset(&sm->tptk, 0, sizeof(sm->tptk)); | ||
159 | os_memset(&sm->gtk, 0, sizeof(sm->gtk)); | ||
160 | + os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); | ||
161 | #ifdef CONFIG_IEEE80211W | ||
162 | os_memset(&sm->igtk, 0, sizeof(sm->igtk)); | ||
163 | + os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); | ||
164 | #endif /* CONFIG_IEEE80211W */ | ||
165 | #ifdef CONFIG_IEEE80211R | ||
166 | os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); | ||
167 | @@ -2986,7 +3009,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) | ||
168 | |||
169 | wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)", | ||
170 | gd.gtk, gd.gtk_len); | ||
171 | - if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) { | ||
172 | + if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) { | ||
173 | os_memset(&gd, 0, sizeof(gd)); | ||
174 | wpa_printf(MSG_DEBUG, "Failed to install the GTK in " | ||
175 | "WNM mode"); | ||
176 | @@ -2998,7 +3021,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) | ||
177 | const struct wpa_igtk_kde *igtk; | ||
178 | |||
179 | igtk = (const struct wpa_igtk_kde *) (buf + 2); | ||
180 | - if (wpa_supplicant_install_igtk(sm, igtk) < 0) | ||
181 | + if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0) | ||
182 | return -1; | ||
183 | #endif /* CONFIG_IEEE80211W */ | ||
184 | } else { | ||
185 | diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h | ||
186 | index afc9e37..9a54631 100644 | ||
187 | --- a/src/rsn_supp/wpa_i.h | ||
188 | +++ b/src/rsn_supp/wpa_i.h | ||
189 | @@ -32,8 +32,10 @@ struct wpa_sm { | ||
190 | int rx_replay_counter_set; | ||
191 | u8 request_counter[WPA_REPLAY_COUNTER_LEN]; | ||
192 | struct wpa_gtk gtk; | ||
193 | + struct wpa_gtk gtk_wnm_sleep; | ||
194 | #ifdef CONFIG_IEEE80211W | ||
195 | struct wpa_igtk igtk; | ||
196 | + struct wpa_igtk igtk_wnm_sleep; | ||
197 | #endif /* CONFIG_IEEE80211W */ | ||
198 | |||
199 | struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ | ||
200 | -- | ||
201 | 2.7.4 \ No newline at end of file | ||