From b7bb83a4bb9f10aadda598bbccf779791bdc060c Mon Sep 17 00:00:00 2001 From: Zhixiong Chi Date: Thu, 22 Sep 2016 15:54:27 +0800 Subject: wpa_supplicant: Security Advisory-CVE-2016-4477 Add CVE-2016-4477 patch for avoiding \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation. Patches came from http://w1.fi/security/2016-1/ (From OE-Core rev: d4d4ed5f31c687b2b2b716ff0fb8ca6c7aa29853) (From OE-Core rev: 9db41b45beae7224ba928f9267046f1b6a8288a0) Signed-off-by: Zhixiong Chi Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- ...commands-with-newline-characters-in-the-s.patch | 54 ++++++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-Reject-SET-commands-with-newline-characters-in-the-s.patch (limited to 'meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-Reject-SET-commands-with-newline-characters-in-the-s.patch') diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-Reject-SET-commands-with-newline-characters-in-the-s.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-Reject-SET-commands-with-newline-characters-in-the-s.patch new file mode 100644 index 0000000000..5375db74b3 --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-Reject-SET-commands-with-newline-characters-in-the-s.patch @@ -0,0 +1,54 @@ +From 2a3f56502b52375c3bf113cf92adfa99bad6b488 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Tue, 5 Apr 2016 23:55:48 +0300 +Subject: [PATCH 3/3] Reject SET commands with newline characters in the + string values + +Many of the global configuration parameters are written as strings +without filtering and if there is an embedded newline character in the +value, unexpected configuration file data might be written. + +This fixes an issue where wpa_supplicant could have updated the +configuration file global parameter with arbitrary data from the control +interface or D-Bus interface. While those interfaces are supposed to be +accessible only for trusted users/applications, it may be possible that +an untrusted user has access to a management software component that +does not validate the value of a parameter before passing it to +wpa_supplicant. + +This could allow such an untrusted user to inject almost arbitrary data +into the configuration file. Such configuration file could result in +wpa_supplicant trying to load a library (e.g., opensc_engine_path, +pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user +controlled location when starting again. This would allow code from that +library to be executed under the wpa_supplicant process privileges. + +Upstream-Status: Backport + +CVE: CVE-2016-4477 + +Signed-off-by: Jouni Malinen +Signed-off-by: Zhixiong Chi +--- + wpa_supplicant/config.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c +index 69152ef..d9a1603 100644 +--- a/wpa_supplicant/config.c ++++ b/wpa_supplicant/config.c +@@ -3764,6 +3764,12 @@ static int wpa_global_config_parse_str(const struct global_parse_data *data, + return -1; + } + ++ if (has_newline(pos)) { ++ wpa_printf(MSG_ERROR, "Line %d: invalid %s value with newline", ++ line, data->name); ++ return -1; ++ } ++ + tmp = os_strdup(pos); + if (tmp == NULL) + return -1; +-- +1.9.1 -- cgit v1.2.3-54-g00ecf