diff options
| author | Divya Chellam <divya.chellam@windriver.com> | 2025-09-09 15:52:33 +0530 |
|---|---|---|
| committer | Steve Sakoman <steve@sakoman.com> | 2025-09-12 09:24:24 -0700 |
| commit | ad403d6f6fe24a37a7d62c29d9df79adaeed7e53 (patch) | |
| tree | 3dd3cc675826550d314f9495e73159d739fc4913 /meta/classes/devtool-source.bbclass | |
| parent | 7c760367807189257895c91fafc5d2967696b092 (diff) | |
| download | poky-ad403d6f6fe24a37a7d62c29d9df79adaeed7e53.tar.gz | |
wpa-supplicant: fix CVE-2022-37660
In hostapd 2.10 and earlier, the PKEX code remains active even after a successful
PKEX association. An attacker that successfully bootstrapped public keys with
another entity using PKEX in the past, will be able to subvert a future bootstrapping
by passively observing public keys, re-using the encrypting element Qi and subtracting
it from the captured message M (X = M - Qi). This will result in the public ephemeral
key X; the only element required to subvert the PKEX association.
CVE-2022-37660-0001, CVE-2022-37660-0002, CVE-2022-37660-0003 and CVE-2022-37660-0004
are dependent commits while CVE-2022-37660-0005 is actual CVE fix.
Reference:
https://security-tracker.debian.org/tracker/CVE-2022-37660
Upstream-patches:
https://git.w1.fi/cgit/hostap/commit/?id=9d3f347a2b14652e767d51142600206a32676b62
https://git.w1.fi/cgit/hostap/commit/?id=80213629981a21825e4688fde1b590e4c4d4bcea
https://git.w1.fi/cgit/hostap/commit/?id=bdcccbc2755dd1a75731496782e02b5435fb9534
https://git.w1.fi/cgit/hostap/commit/?id=d7be749335f2585658cf98c4f0e7d6cd5ac06865
https://git.w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4
(From OE-Core rev: 3dd917c52ace30607800f0b70a52a52662dda731)
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/classes/devtool-source.bbclass')
0 files changed, 0 insertions, 0 deletions