diff options
| author | Divya Chellam <divya.chellam@windriver.com> | 2025-09-09 15:42:41 +0530 |
|---|---|---|
| committer | Steve Sakoman <steve@sakoman.com> | 2025-09-22 13:17:52 -0700 |
| commit | 6b9319977638f62f94c2fcf06e63e5a75fbd9e01 (patch) | |
| tree | 9048f30fa596e34d67c6e489b875832adf23af0b /meta/recipes-bsp/grub/grub2.inc | |
| parent | 31b2c45764702e0dfac4661db686f48374cee787 (diff) | |
| download | poky-6b9319977638f62f94c2fcf06e63e5a75fbd9e01.tar.gz | |
wpa-supplicant: fix CVE-2022-37660
In hostapd 2.10 and earlier, the PKEX code remains active even after a successful
PKEX association. An attacker that successfully bootstrapped public keys with
another entity using PKEX in the past, will be able to subvert a future bootstrapping
by passively observing public keys, re-using the encrypting element Qi and subtracting
it from the captured message M (X = M - Qi). This will result in the public ephemeral
key X; the only element required to subvert the PKEX association.
CVE-2022-37660-0001, CVE-2022-37660-0002, CVE-2022-37660-0003 and CVE-2022-37660-0004
are dependent commits while CVE-2022-37660-0005 is actual CVE fix.
Reference:
https://security-tracker.debian.org/tracker/CVE-2022-37660
Upstream-patches:
https://git.w1.fi/cgit/hostap/commit/?id=9d3f347a2b14652e767d51142600206a32676b62
https://git.w1.fi/cgit/hostap/commit/?id=80213629981a21825e4688fde1b590e4c4d4bcea
https://git.w1.fi/cgit/hostap/commit/?id=bdcccbc2755dd1a75731496782e02b5435fb9534
https://git.w1.fi/cgit/hostap/commit/?id=d7be749335f2585658cf98c4f0e7d6cd5ac06865
https://git.w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4
(From OE-Core rev: 91848ac13ec18f98469f7f8ed68c6153fea31607)
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-bsp/grub/grub2.inc')
0 files changed, 0 insertions, 0 deletions