rpms/wpa_supplicant
7
0
Fork 0
Code Issues Pull Requests Releases Activity

P2P: Fix copying of secondary device types for P2P group client

Browse Source 
CVE-2021-0326

Upstream advisory: https://w1.fi/security/2020-2/wpa_supplicant-p2p-group-info-processing-vulnerability.txt

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
This commit is contained in:
Davide Caratti 2021-02-04 11:47:34 +01:00
parent 0b9539a24d
commit cd7668703c
2 changed files with 46 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
0001-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch Normal file
View File

@ -0,0 +1,39 @@
From 947272febe24a8f0ea828b5b2f35f13c3821901e Mon Sep 17 00:00:00 2001
Message-Id: <947272febe24a8f0ea828b5b2f35f13c3821901e.1612435525.git.davide.caratti@gmail.com>
From: Jouni Malinen <jouni@codeaurora.org>
Date: Mon, 9 Nov 2020 11:43:12 +0200
Subject: [PATCH] P2P: Fix copying of secondary device types for P2P group
client
Parsing and copying of WPS secondary device types list was verifying
that the contents is not too long for the internal maximum in the case
of WPS messages, but similar validation was missing from the case of P2P
group information which encodes this information in a different
attribute. This could result in writing beyond the memory area assigned
for these entries and corrupting memory within an instance of struct
p2p_device. This could result in invalid operations and unexpected
behavior when trying to free pointers from that corrupted memory.
Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27269
Fixes: e57ae6e19edf ("P2P: Keep track of secondary device types for peers")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
---
src/p2p/p2p.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
index 74b7b52ae..5cbfc217f 100644
--- a/src/p2p/p2p.c
+++ b/src/p2p/p2p.c
@@ -453,6 +453,8 @@ static void p2p_copy_client_info(struct p2p_device *dev,
dev->info.config_methods = cli->config_methods;
os_memcpy(dev->info.pri_dev_type, cli->pri_dev_type, 8);
dev->info.wps_sec_dev_type_list_len = 8 * cli->num_sec_dev_types;
+ if (dev->info.wps_sec_dev_type_list_len > WPS_SEC_DEV_TYPE_MAX_LEN)
+ dev->info.wps_sec_dev_type_list_len = WPS_SEC_DEV_TYPE_MAX_LEN;
os_memcpy(dev->info.wps_sec_dev_type_list, cli->sec_dev_types,
dev->info.wps_sec_dev_type_list_len);
}
--
2.29.2

8
wpa_supplicant.spec
View File

@ -9,7 +9,7 @@ Summary: WPA/WPA2/IEEE 802.1X Supplicant
Name: wpa_supplicant
Epoch: 1
Version: 2.9
Release: 10%{?dist}
Release: 11%{?dist}
License: BSD
Source0: http://w1.fi/releases/%{name}-%{version}.tar.gz
Source1: wpa_supplicant.conf
@ -43,6 +43,9 @@ Patch9: 0001-D-Bus-Allow-changing-an-interface-bridge-via-D-Bus.patch
#expose OWE capability in D-Bus
Patch10: 0001-dbus-Export-OWE-capability-and-OWE-BSS-key_mgmt.patch
#fix for CVE-2021-0326
Patch11: 0001-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch
URL: http://w1.fi/wpa_supplicant/
%if %with gui
@ -202,6 +205,9 @@ chmod -R 0644 wpa_supplicant/examples/*.py
%changelog
* Thu Feb 4 2021 Davide Caratti <dcaratti@redhat.com> - 1:2.9-11
- Fix copying of secondary device types for P2P group client (CVE-2021-0326)
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1:2.9-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild