Hi Martin,
On Sat, 2021-03-20 at 09:09 +0100, Martin Jansa wrote:
> From: Stefan Ghinea <stefan.ghi...@windriver.com>
>
> A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant
> before 2.10 processes P2P (Wi-Fi Direct) provision discovery
> requests.
> It could result in denial of service or other impact (potentially
> execution of arbitrary code), for an attacker within radio range.
>
> References:
> https://nvd.nist.gov/vuln/detail/CVE-2021-27803
>
> Upstream patches:
> https://w1.fi/cgit/hostap/commit/?id=8460e3230988ef2ec13ce6b69b687e941f6cdb32
I had this one already in my queue and just sent it out.
Thanks,
Anuj
>
> Signed-off-by: Stefan Ghinea <stefan.ghi...@windriver.com>
> Signed-off-by: Richard Purdie <richard.pur...@linuxfoundation.org>
> ---
> .../wpa-supplicant/CVE-2021-27803.patch | 58
> +++++++++++++++++++
> .../wpa-supplicant/wpa-supplicant_2.9.bb | 1 +
> 2 files changed, 59 insertions(+)
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-
> supplicant/CVE-2021-27803.patch
>
> diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-
> supplicant/CVE-2021-27803.patch b/meta/recipes-connectivity/wpa-
> supplicant/wpa-supplicant/CVE-2021-27803.patch
> new file mode 100644
> index 0000000000..004b1dbd19
> --- /dev/null
> +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-
> 2021-27803.patch
> @@ -0,0 +1,58 @@
> +From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00
> 2001
> +From: Jouni Malinen <jo...@codeaurora.org>
> +Date: Tue, 8 Dec 2020 23:52:50 +0200
> +Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD
> Request
> +
> +p2p_add_device() may remove the oldest entry if there is no room in
> the
> +peer table for a new peer. This would result in any pointer to that
> +removed entry becoming stale. A corner case with an invalid PD
> Request
> +frame could result in such a case ending up using (read+write) freed
> +memory. This could only by triggered when the peer table has reached
> its
> +maximum size and the PD Request frame is received from the P2P
> Device
> +Address of the oldest remaining entry and the frame has incorrect
> P2P
> +Device Address in the payload.
> +
> +Fix this by fetching the dev pointer again after having called
> +p2p_add_device() so that the stale pointer cannot be used.
> +
> +Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision
> Discovery Request")
> +Signed-off-by: Jouni Malinen <jo...@codeaurora.org>
> +
> +Upstream-Status: Backport
> +CVE: CVE-2021-27803
> +
> +Reference to upstream patch:
> +[
> https://w1.fi/cgit/hostap/commit/?id=8460e3230988ef2ec13ce6b69b687e941f6cdb32
> ]
> +
> +Signed-off-by: Stefan Ghinea <stefan.ghi...@windriver.com>
> +---
> + src/p2p/p2p_pd.c | 12 +++++-------
> + 1 file changed, 5 insertions(+), 7 deletions(-)
> +
> +diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c
> +index 3994ec0..05fd593 100644
> +--- a/src/p2p/p2p_pd.c
> ++++ b/src/p2p/p2p_pd.c
> +@@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2p_data
> *p2p, const u8 *sa,
> + goto out;
> + }
> +
> ++ dev = p2p_get_device(p2p, sa);
> + if (!dev) {
> +- dev = p2p_get_device(p2p, sa);
> +- if (!dev) {
> +- p2p_dbg(p2p,
> +- "Provision Discovery device
> not found "
> +- MACSTR, MAC2STR(sa));
> +- goto out;
> +- }
> ++ p2p_dbg(p2p,
> ++ "Provision Discovery device not found
> "
> ++ MACSTR, MAC2STR(sa));
> ++ goto out;
> + }
> + } else if (msg.wfd_subelems) {
> + wpabuf_free(dev->info.wfd_subelems);
> +--
> +2.17.1
> +
> diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-
> supplicant_2.9.bb b/meta/recipes-connectivity/wpa-supplicant/wpa-
> supplicant_2.9.bb
> index 85ac28d881..0f2b7407e9 100644
> --- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.9.bb
> +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.9.bb
> @@ -30,6 +30,7 @@ SRC_URI = "
> http://w1.fi/releases/wpa_supplicant-${PV}.tar.gz \
>
> file://0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch
> \
>
> file://0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch
> \
> file://CVE-2021-0326.patch \
> + file://CVE-2021-27803.patch \
> "
> SRC_URI[md5sum] = "2d2958c782576dc9901092fbfecb4190"
> SRC_URI[sha256sum] =
> "fcbdee7b4a64bea8177973299c8c824419c413ec2e3a95db63dd6a5dc3541f17"
>
>
>
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#149758):
https://lists.openembedded.org/g/openembedded-core/message/149758
Mute This Topic: https://lists.openembedded.org/mt/81474576/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
