diff options
-rw-r--r-- | debian/changelog | 8 | ||||
-rw-r--r-- | debian/patches/2019-5/0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch | 45 | ||||
-rw-r--r-- | debian/patches/2019-5/0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch | 45 | ||||
-rw-r--r-- | debian/patches/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt | 41 | ||||
-rw-r--r-- | debian/patches/series | 2 | ||||
-rw-r--r-- | src/eap_peer/eap_pwd.c | 9 | ||||
-rw-r--r-- | src/eap_server/eap_server_pwd.c | 8 |
7 files changed, 156 insertions, 2 deletions
diff --git a/debian/changelog b/debian/changelog index d4d0a8e..35a81f4 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,11 @@ +wpa (2:2.7+git20190128+0c1e29f-5) unstable; urgency=high + + * Fix security issue 2019-5: + - EAP-pwd message reassembly issue with unexpected fragment + (Closes: #927463, no CVE assigned). + + -- Andrej Shadura <andrewsh@debian.org> Fri, 26 Apr 2019 14:55:52 +0200 + wpa (2:2.7+git20190128+0c1e29f-4) unstable; urgency=high * Apply security fixes (Closes: #926801): diff --git a/debian/patches/2019-5/0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch b/debian/patches/2019-5/0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch new file mode 100644 index 0000000..620d67d --- /dev/null +++ b/debian/patches/2019-5/0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch @@ -0,0 +1,45 @@ +From fe76f487e28bdc61940f304f153a954cf36935ea Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <jouni@codeaurora.org> +Date: Wed, 17 Apr 2019 01:55:32 +0300 +Subject: [PATCH 1/3] EAP-pwd server: Fix reassembly buffer handling + +data->inbuf allocation might fail and if that were to happen, the next +fragment in the exchange could have resulted in NULL pointer +dereference. Unexpected fragment with more bit might also be able to +trigger this. Fix that by explicitly checking for data->inbuf to be +available before using it. + +Signed-off-by: Jouni Malinen <jouni@codeaurora.org> +--- + src/eap_server/eap_server_pwd.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/src/eap_server/eap_server_pwd.c b/src/eap_server/eap_server_pwd.c +index 11bef55..38e2af8 100644 +--- a/src/eap_server/eap_server_pwd.c ++++ b/src/eap_server/eap_server_pwd.c +@@ -912,6 +912,12 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv, + * the first and all intermediate fragments have the M bit set + */ + if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { ++ if (!data->inbuf) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: No buffer for reassembly"); ++ eap_pwd_state(data, FAILURE); ++ return; ++ } + if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) { + wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow " + "attack detected! (%d+%d > %d)", +@@ -932,7 +938,7 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv, + * last fragment won't have the M bit set (but we're obviously + * buffering fragments so that's how we know it's the last) + */ +- if (data->in_frag_pos) { ++ if (data->in_frag_pos && data->inbuf) { + pos = wpabuf_head_u8(data->inbuf); + len = data->in_frag_pos; + wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", +-- +2.7.4 + diff --git a/debian/patches/2019-5/0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch b/debian/patches/2019-5/0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch new file mode 100644 index 0000000..1a23e0f --- /dev/null +++ b/debian/patches/2019-5/0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch @@ -0,0 +1,45 @@ +From d2d1a324ce937628e4d9d9999fe113819b7d4478 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <jouni@codeaurora.org> +Date: Wed, 17 Apr 2019 02:21:20 +0300 +Subject: [PATCH 3/3] EAP-pwd peer: Fix reassembly buffer handling + +Unexpected fragment might result in data->inbuf not being allocated +before processing and that could have resulted in NULL pointer +dereference. Fix that by explicitly checking for data->inbuf to be +available before using it. + +Signed-off-by: Jouni Malinen <jouni@codeaurora.org> +--- + src/eap_peer/eap_pwd.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c +index 46894a5..76fcad4 100644 +--- a/src/eap_peer/eap_pwd.c ++++ b/src/eap_peer/eap_pwd.c +@@ -932,6 +932,13 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, + * buffer and ACK the fragment + */ + if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { ++ if (!data->inbuf) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: No buffer for reassembly"); ++ ret->methodState = METHOD_DONE; ++ ret->decision = DECISION_FAIL; ++ return NULL; ++ } + data->in_frag_pos += len; + if (data->in_frag_pos > wpabuf_size(data->inbuf)) { + wpa_printf(MSG_INFO, "EAP-pwd: Buffer overflow attack " +@@ -958,7 +965,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, + /* + * we're buffering and this is the last fragment + */ +- if (data->in_frag_pos) { ++ if (data->in_frag_pos && data->inbuf) { + wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", + (int) len); + pos = wpabuf_head_u8(data->inbuf); +-- +2.7.4 + diff --git a/debian/patches/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt b/debian/patches/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt new file mode 100644 index 0000000..5366f78 --- /dev/null +++ b/debian/patches/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt @@ -0,0 +1,41 @@ +EAP-pwd message reassembly issue with unexpected fragment + +Published: April 18, 2019 +Latest version available from: https://w1.fi/security/2019-5/ + +Vulnerability + +EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant (EAP +peer) was discovered not to validate fragmentation reassembly state +properly for a case where an unexpected fragment could be received. This +could result in process termination due to NULL pointer dereference. + +An attacker in radio range of a station device with wpa_supplicant +network profile enabling use of EAP-pwd could cause the wpa_supplicant +process to terminate by constructing unexpected sequence of EAP +messages. An attacker in radio range of an access point that points to +hostapd as an authentication server with EAP-pwd user enabled in runtime +configuration (or in non-WLAN uses of EAP authentication as long as the +attacker can send EAP-pwd messages to the server) could cause the +hostapd process to terminate by constructing unexpected sequence of EAP +messages. + + +Vulnerable versions/configurations + +All hostapd and wpa_supplicant versions with EAP-pwd support +(CONFIG_EAP_PWD=y in the build configuration and EAP-pwd being enabled +in the runtime configuration) are vulnerable against the process +termination (denial of service) attack. + + +Possible mitigation steps + +- Merge the following commits to wpa_supplicant/hostapd and rebuild: + + EAP-pwd peer: Fix reassembly buffer handling + EAP-pwd server: Fix reassembly buffer handling + + These patches are available from https://w1.fi/security/2019-5/ + +- Update to wpa_supplicant/hostapd v2.8 or newer, once available diff --git a/debian/patches/series b/debian/patches/series index 5f09aea..ca66b1d 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -22,3 +22,5 @@ fix-ENGINE-support-with-openssl-1.1.patch 2019-sae-eap/0012-EAP-pwd-server-Detect-reflection-attacks.patch 2019-sae-eap/0013-EAP-pwd-client-Verify-received-scalar-and-element.patch 2019-sae-eap/0014-EAP-pwd-Check-element-x-y-coordinates-explicitly.patch +2019-5/0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch +2019-5/0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c index f37b974..5758307 100644 --- a/src/eap_peer/eap_pwd.c +++ b/src/eap_peer/eap_pwd.c @@ -969,6 +969,13 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, * buffer and ACK the fragment */ if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { + if (!data->inbuf) { + wpa_printf(MSG_DEBUG, + "EAP-pwd: No buffer for reassembly"); + ret->methodState = METHOD_DONE; + ret->decision = DECISION_FAIL; + return NULL; + } data->in_frag_pos += len; if (data->in_frag_pos > wpabuf_size(data->inbuf)) { wpa_printf(MSG_INFO, "EAP-pwd: Buffer overflow attack " @@ -995,7 +1002,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, /* * we're buffering and this is the last fragment */ - if (data->in_frag_pos) { + if (data->in_frag_pos && data->inbuf) { wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", (int) len); pos = wpabuf_head_u8(data->inbuf); diff --git a/src/eap_server/eap_server_pwd.c b/src/eap_server/eap_server_pwd.c index f6c75cf..fc497bb 100644 --- a/src/eap_server/eap_server_pwd.c +++ b/src/eap_server/eap_server_pwd.c @@ -947,6 +947,12 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv, * the first and all intermediate fragments have the M bit set */ if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { + if (!data->inbuf) { + wpa_printf(MSG_DEBUG, + "EAP-pwd: No buffer for reassembly"); + eap_pwd_state(data, FAILURE); + return; + } if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) { wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow " "attack detected! (%d+%d > %d)", @@ -967,7 +973,7 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv, * last fragment won't have the M bit set (but we're obviously * buffering fragments so that's how we know it's the last) */ - if (data->in_frag_pos) { + if (data->in_frag_pos && data->inbuf) { pos = wpabuf_head_u8(data->inbuf); len = data->in_frag_pos; wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", |