ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2024-11-07 07:26:13 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: wpa-supplicant, hostapd: Fix CVE-2021-27803.

Browse source 
See <https://w1.fi/security/2021-1/wpa_supplicant-p2p-provision-discovery-processing-vulnerability.txt>.

* gnu/packages/patches/wpa-supplicant-CVE-2021-27803.patch: New patch.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/admin.scm (wpa-supplicant-minimal, hostapd): Apply it.
This commit is contained in:
Léo Le Bouter 2021-02-28 03:03:39 +01:00
parent 23dcf4339d
commit 83a614b6c3
No known key found for this signature in database
GPG key ID: 45A8B1E86BCD10A6
3 changed files with 57 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
gnu/local.mk
View file

@ -1730,6 +1730,7 @@ dist_patch_DATA = \
%D%/packages/patches/wordnet-CVE-2008-2149.patch \
%D%/packages/patches/wordnet-CVE-2008-3908-pt1.patch \
%D%/packages/patches/wordnet-CVE-2008-3908-pt2.patch \
%D%/packages/patches/wpa-supplicant-CVE-2021-27803.patch \
%D%/packages/patches/x265-arm-flags.patch \
%D%/packages/patches/xf86-video-ark-remove-mibstore.patch \
%D%/packages/patches/xf86-video-mach64-glibc-2.20.patch \

8
gnu/packages/admin.scm
View file

@ -1656,7 +1656,9 @@ (define-public wpa-supplicant-minimal
;; Disable D-Bus to save ~14MiB on the closure size.
(("^CONFIG_CTRL_IFACE_DBUS" line _)
(string-append "#" line)))
#t))))
#t))
(patches
(search-patches "wpa-supplicant-CVE-2021-27803.patch"))))
(build-system gnu-build-system)
(arguments
`(#:phases
@ -1820,7 +1822,9 @@ (define-public hostapd
".tar.gz"))
(sha256
(base32
"1mrbvg4v7vm7mknf0n29mf88k3s4a4qj6r4d51wq8hmjj1m7s7c8"))))
"1mrbvg4v7vm7mknf0n29mf88k3s4a4qj6r4d51wq8hmjj1m7s7c8"))
(patches
(search-patches "wpa-supplicant-CVE-2021-27803.patch"))))
(build-system gnu-build-system)
(arguments
`(#:phases

50
gnu/packages/patches/wpa-supplicant-CVE-2021-27803.patch Normal file
View file

@ -0,0 +1,50 @@
From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <jouni@codeaurora.org>
Date: Tue, 8 Dec 2020 23:52:50 +0200
Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD Request
p2p_add_device() may remove the oldest entry if there is no room in the
peer table for a new peer. This would result in any pointer to that
removed entry becoming stale. A corner case with an invalid PD Request
frame could result in such a case ending up using (read+write) freed
memory. This could only by triggered when the peer table has reached its
maximum size and the PD Request frame is received from the P2P Device
Address of the oldest remaining entry and the frame has incorrect P2P
Device Address in the payload.
Fix this by fetching the dev pointer again after having called
p2p_add_device() so that the stale pointer cannot be used.
Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
---
src/p2p/p2p_pd.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c
index 3994ec03f86b..05fd593494ef 100644
--- a/src/p2p/p2p_pd.c
+++ b/src/p2p/p2p_pd.c
@@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2p_data *p2p, const u8 *sa,
goto out;
}
+ dev = p2p_get_device(p2p, sa);
if (!dev) {
- dev = p2p_get_device(p2p, sa);
- if (!dev) {
- p2p_dbg(p2p,
- "Provision Discovery device not found "
- MACSTR, MAC2STR(sa));
- goto out;
- }
+ p2p_dbg(p2p,
+ "Provision Discovery device not found "
+ MACSTR, MAC2STR(sa));
+ goto out;
}
} else if (msg.wfd_subelems) {
wpabuf_free(dev->info.wfd_subelems);
--
2.25.1