summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLéo Le Bouter <lle-bout@zaclys.net>2021-02-28 03:03:39 +0100
committerLéo Le Bouter <lle-bout@zaclys.net>2021-02-28 03:03:39 +0100
commit83a614b6c3dfebee653e656c62635e65faf9e15a (patch)
tree22347f9196f93622fdcc20f22cca7b75b1e40716
parent23dcf4339d1dc102b2c509a151734f4caff793bd (diff)
gnu: wpa-supplicant, hostapd: Fix CVE-2021-27803.
See <https://w1.fi/security/2021-1/wpa_supplicant-p2p-provision-discovery-processing-vulnerability.txt>. * gnu/packages/patches/wpa-supplicant-CVE-2021-27803.patch: New patch. * gnu/local.mk (dist_patch_DATA): Register it. * gnu/packages/admin.scm (wpa-supplicant-minimal, hostapd): Apply it.
-rw-r--r--gnu/local.mk1
-rw-r--r--gnu/packages/admin.scm8
-rw-r--r--gnu/packages/patches/wpa-supplicant-CVE-2021-27803.patch50
3 files changed, 57 insertions, 2 deletions
diff --git a/gnu/local.mk b/gnu/local.mk
index 8d1465158a..f8ff065242 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1730,6 +1730,7 @@ dist_patch_DATA = \
%D%/packages/patches/wordnet-CVE-2008-2149.patch \
%D%/packages/patches/wordnet-CVE-2008-3908-pt1.patch \
%D%/packages/patches/wordnet-CVE-2008-3908-pt2.patch \
+ %D%/packages/patches/wpa-supplicant-CVE-2021-27803.patch \
%D%/packages/patches/x265-arm-flags.patch \
%D%/packages/patches/xf86-video-ark-remove-mibstore.patch \
%D%/packages/patches/xf86-video-mach64-glibc-2.20.patch \
diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index cf27eea084..2ca99774b8 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -1656,7 +1656,9 @@ features of sudo with a fraction of the codebase.")
;; Disable D-Bus to save ~14MiB on the closure size.
(("^CONFIG_CTRL_IFACE_DBUS" line _)
(string-append "#" line)))
- #t))))
+ #t))
+ (patches
+ (search-patches "wpa-supplicant-CVE-2021-27803.patch"))))
(build-system gnu-build-system)
(arguments
`(#:phases
@@ -1820,7 +1822,9 @@ command.")
".tar.gz"))
(sha256
(base32
- "1mrbvg4v7vm7mknf0n29mf88k3s4a4qj6r4d51wq8hmjj1m7s7c8"))))
+ "1mrbvg4v7vm7mknf0n29mf88k3s4a4qj6r4d51wq8hmjj1m7s7c8"))
+ (patches
+ (search-patches "wpa-supplicant-CVE-2021-27803.patch"))))
(build-system gnu-build-system)
(arguments
`(#:phases
diff --git a/gnu/packages/patches/wpa-supplicant-CVE-2021-27803.patch b/gnu/packages/patches/wpa-supplicant-CVE-2021-27803.patch
new file mode 100644
index 0000000000..1942bb3d55
--- /dev/null
+++ b/gnu/packages/patches/wpa-supplicant-CVE-2021-27803.patch
@@ -0,0 +1,50 @@
+From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@codeaurora.org>
+Date: Tue, 8 Dec 2020 23:52:50 +0200
+Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD Request
+
+p2p_add_device() may remove the oldest entry if there is no room in the
+peer table for a new peer. This would result in any pointer to that
+removed entry becoming stale. A corner case with an invalid PD Request
+frame could result in such a case ending up using (read+write) freed
+memory. This could only by triggered when the peer table has reached its
+maximum size and the PD Request frame is received from the P2P Device
+Address of the oldest remaining entry and the frame has incorrect P2P
+Device Address in the payload.
+
+Fix this by fetching the dev pointer again after having called
+p2p_add_device() so that the stale pointer cannot be used.
+
+Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+---
+ src/p2p/p2p_pd.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c
+index 3994ec03f86b..05fd593494ef 100644
+--- a/src/p2p/p2p_pd.c
++++ b/src/p2p/p2p_pd.c
+@@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2p_data *p2p, const u8 *sa,
+ goto out;
+ }
+
++ dev = p2p_get_device(p2p, sa);
+ if (!dev) {
+- dev = p2p_get_device(p2p, sa);
+- if (!dev) {
+- p2p_dbg(p2p,
+- "Provision Discovery device not found "
+- MACSTR, MAC2STR(sa));
+- goto out;
+- }
++ p2p_dbg(p2p,
++ "Provision Discovery device not found "
++ MACSTR, MAC2STR(sa));
++ goto out;
+ }
+ } else if (msg.wfd_subelems) {
+ wpabuf_free(dev->info.wfd_subelems);
+--
+2.25.1
+