mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-16 15:32:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

wpa-supplicant: backport a patch to fix CVE-2015-1863

Browse Source 
This fix was included in the master branch with the upgrade
to 2.4, backport it to fido as the vulnerability was already
present in 2.3.

(From OE-Core rev: 12fc04731d26597bfb9d9f1713c96b11c8186c43)

Signed-off-by: Joshua Lock <joshua.lock@collabora.co.uk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Joshua Lock
2015-08-18 13:38:52 +01:00
committed by Richard Purdie
parent 982baf1130
commit 2adb210c8c
2 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-connectivity/wpa-supplicant/wpa-supplicant.inc
View File

@@ -25,6 +25,7 @@ SRC_URI = "http://hostap.epitest.fi/releases/wpa_supplicant-${PV}.tar.gz \
file://wpa_supplicant.conf-sane \
file://99_wpa_supplicant \
file://fix-libnl3-host-contamination.patch \
file://0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch \
file://0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch \
file://0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch \
file://0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch \

47
meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Normal file
View File

@@ -0,0 +1,47 @@
From 9ed4eee345f85e3025c33c6e20aa25696e341ccd Mon Sep 17 00:00:00 2001
From: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Tue, 7 Apr 2015 11:32:11 +0300
Subject: [PATCH] P2P: Validate SSID element length before copying it
(CVE-2015-1863)
This fixes a possible memcpy overflow for P2P dev->oper_ssid in
p2p_add_device(). The length provided by the peer device (0..255 bytes)
was used without proper bounds checking and that could have resulted in
arbitrary data of up to 223 bytes being written beyond the end of the
dev->oper_ssid[] array (of which about 150 bytes would be beyond the
heap allocation) when processing a corrupted management frame for P2P
peer discovery purposes.
This could result in corrupted state in heap, unexpected program
behavior due to corrupted P2P peer device information, denial of service
due to process crash, exposure of memory contents during GO Negotiation,
and potentially arbitrary code execution.
Thanks to Google security team for reporting this issue and smart
hardware research group of Alibaba security team for discovering it.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Upstream-Status: Backport
Signed-off-by: Yue Tao <yue.tao@windriver.com>
---
src/p2p/p2p.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
index f584fae..a45fe73 100644
--- a/src/p2p/p2p.c
+++ b/src/p2p/p2p.c
@@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq,
if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
os_memcpy(dev->interface_addr, addr, ETH_ALEN);
if (msg.ssid &&
+ msg.ssid[1] <= sizeof(dev->oper_ssid) &&
(msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
!= 0)) {
--
1.7.9.5