~alpine/aports

This thread contains a patchset. You're looking at the original emails, but you may wish to use the patch review UI. Review patch
1

[alpine-aports] [PATCH 1/2] main/wpa_supplicant: install sample config to /usr/share/doc/...

Details
Message ID
<1445780063-28820-1-git-send-email-soeren+git@soeren-tempel.net>
Sender timestamp
1445780062
DKIM signature
missing
Download raw message
Patch: +2 -6
---
 main/wpa_supplicant/APKBUILD | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/main/wpa_supplicant/APKBUILD b/main/wpa_supplicant/APKBUILD
index e827a3a..781c07c 100644
--- a/main/wpa_supplicant/APKBUILD
+++ b/main/wpa_supplicant/APKBUILD
@@ -2,7 +2,7 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=wpa_supplicant
pkgver=2.4
pkgrel=7
pkgrel=8
pkgdesc="A utility providing key negotiation for WPA wireless networks"
url="https://w1.fi/wpa_supplicant/"
arch="all"
@@ -42,10 +42,6 @@ prepare() {
build() {
	cd "$_builddir"/wpa_supplicant
	make LIBDIR=/lib BINDIR=/sbin || return 1
	# comment out the network={ } stansas in config
	sed -i	-e '/^network=/,/}/s/^/#/' \
		-e '/^freq_list/s/^/#/' \
		wpa_supplicant.conf
	make wpa_gui-qt4 || return 1
	make eapol_test || return 1
}
@@ -54,7 +50,7 @@ package() {
	cd "$_builddir"/wpa_supplicant
	make DESTDIR="$pkgdir" LIBDIR=/lib BINDIR=/sbin install || return 1
	install -Dm644 wpa_supplicant.conf \
		"$pkgdir"/etc/wpa_supplicant/wpa_supplicant.conf || return 1
		"$pkgdir"/usr/share/doc/wpa_supplicant/examples/wpa_supplicant.conf || return 1
	install -Dm755 "$srcdir"/wpa_cli.sh \
		"$pkgdir"/etc/wpa_supplicant/wpa_cli.sh || return 1

-- 
2.6.1



---
Unsubscribe:  alpine-aports+unsubscribe@lists.alpinelinux.org
Help:         alpine-aports+help@lists.alpinelinux.org
---

[alpine-aports] [PATCH 2/2] main/wpa_supplicant: upgrade to 2.5

Details
Message ID
<1445780063-28820-2-git-send-email-soeren+git@soeren-tempel.net>
In-Reply-To
<1445780063-28820-1-git-send-email-soeren+git@soeren-tempel.net> (view parent)
Sender timestamp
1445780063
DKIM signature
missing
Download raw message
Patch: +17 -446
---
 ...r-Fix-payload-length-validation-for-Commi.patch | 73 ----------------------
 ...ver-Fix-payload-length-validation-for-Com.patch | 66 -------------------
 ...r-Fix-Total-Length-parsing-for-fragment-r.patch | 52 ---------------
 ...ver-Fix-Total-Length-parsing-for-fragment.patch | 50 ---------------
 ...eer-Fix-asymmetric-fragmentation-behavior.patch | 32 ----------
 main/wpa_supplicant/APKBUILD                       | 49 +++------------
 main/wpa_supplicant/CVE-2015-1863.patch            | 42 -------------
 main/wpa_supplicant/CVE-2015-4141.patch            | 49 ---------------
 main/wpa_supplicant/CVE-2015-4142.patch            | 41 ------------
 main/wpa_supplicant/config                         |  9 +++
 10 files changed, 17 insertions(+), 446 deletions(-)
 delete mode 100644 main/wpa_supplicant/0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch
 delete mode 100644 main/wpa_supplicant/0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch
 delete mode 100644 main/wpa_supplicant/0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch
 delete mode 100644 main/wpa_supplicant/0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch
 delete mode 100644 main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch
 delete mode 100644 main/wpa_supplicant/CVE-2015-1863.patch
 delete mode 100644 main/wpa_supplicant/CVE-2015-4141.patch
 delete mode 100644 main/wpa_supplicant/CVE-2015-4142.patch

diff --git a/main/wpa_supplicant/0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch b/main/wpa_supplicant/0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch
deleted file mode 100644
index 91627fb..0000000
--- a/main/wpa_supplicant/0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch
@@ -1,73 +0,0 @@
From dd2f043c9c43d156494e33d7ce22db96e6ef42c7 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Fri, 1 May 2015 16:37:45 +0300
Subject: [PATCH 1/5] EAP-pwd peer: Fix payload length validation for Commit
 and Confirm

The length of the received Commit and Confirm message payloads was not
checked before reading them. This could result in a buffer read
overflow when processing an invalid message.

Fix this by verifying that the payload is of expected length before
processing it. In addition, enforce correct state transition sequence to
make sure there is no unexpected behavior if receiving a Commit/Confirm
message before the previous exchanges have been completed.

Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/eap_peer/eap_pwd.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
index f2b0926..a629437 100644
--- a/src/eap_peer/eap_pwd.c
+++ b/src/eap_peer/eap_pwd.c
@@ -355,6 +355,23 @@ eap_pwd_perform_commit_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
 	BIGNUM *mask = NULL, *x = NULL, *y = NULL, *cofactor = NULL;
 	u16 offset;
 	u8 *ptr, *scalar = NULL, *element = NULL;
+	size_t prime_len, order_len;
+
+	if (data->state != PWD_Commit_Req) {
+		ret->ignore = TRUE;
+		goto fin;
+	}
+
+	prime_len = BN_num_bytes(data->grp->prime);
+	order_len = BN_num_bytes(data->grp->order);
+
+	if (payload_len != 2 * prime_len + order_len) {
+		wpa_printf(MSG_INFO,
+			   "EAP-pwd: Unexpected Commit payload length %u (expected %u)",
+			   (unsigned int) payload_len,
+			   (unsigned int) (2 * prime_len + order_len));
+		goto fin;
+	}
 
 	if (((data->private_value = BN_new()) == NULL) ||
 	    ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) ||
@@ -554,6 +571,18 @@ eap_pwd_perform_confirm_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
 	u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr;
 	int offset;
 
+	if (data->state != PWD_Confirm_Req) {
+		ret->ignore = TRUE;
+		goto fin;
+	}
+
+	if (payload_len != SHA256_MAC_LEN) {
+		wpa_printf(MSG_INFO,
+			   "EAP-pwd: Unexpected Confirm payload length %u (expected %u)",
+			   (unsigned int) payload_len, SHA256_MAC_LEN);
+		goto fin;
+	}
+
 	/*
 	 * first build up the ciphersuite which is group | random_function |
 	 *	prf
--- 
1.9.1

diff --git a/main/wpa_supplicant/0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch b/main/wpa_supplicant/0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch
deleted file mode 100644
index 5dca20b..0000000
--- a/main/wpa_supplicant/0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch
@@ -1,66 +0,0 @@
From e28a58be26184c2a23f80b410e0997ef1bd5d578 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Fri, 1 May 2015 16:40:44 +0300
Subject: [PATCH 2/5] EAP-pwd server: Fix payload length validation for Commit
 and Confirm

The length of the received Commit and Confirm message payloads was not
checked before reading them. This could result in a buffer read
overflow when processing an invalid message.

Fix this by verifying that the payload is of expected length before
processing it. In addition, enforce correct state transition sequence to
make sure there is no unexpected behavior if receiving a Commit/Confirm
message before the previous exchanges have been completed.

Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/eap_server/eap_server_pwd.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/src/eap_server/eap_server_pwd.c b/src/eap_server/eap_server_pwd.c
index 66bd5d2..3189105 100644
--- a/src/eap_server/eap_server_pwd.c
+++ b/src/eap_server/eap_server_pwd.c
@@ -656,9 +656,21 @@ eap_pwd_process_commit_resp(struct eap_sm *sm, struct eap_pwd_data *data,
 	BIGNUM *x = NULL, *y = NULL, *cofactor = NULL;
 	EC_POINT *K = NULL, *point = NULL;
 	int res = 0;
+	size_t prime_len, order_len;
 
 	wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response");
 
+	prime_len = BN_num_bytes(data->grp->prime);
+	order_len = BN_num_bytes(data->grp->order);
+
+	if (payload_len != 2 * prime_len + order_len) {
+		wpa_printf(MSG_INFO,
+			   "EAP-pwd: Unexpected Commit payload length %u (expected %u)",
+			   (unsigned int) payload_len,
+			   (unsigned int) (2 * prime_len + order_len));
+		goto fin;
+	}
+
 	if (((data->peer_scalar = BN_new()) == NULL) ||
 	    ((data->k = BN_new()) == NULL) ||
 	    ((cofactor = BN_new()) == NULL) ||
@@ -774,6 +786,13 @@ eap_pwd_process_confirm_resp(struct eap_sm *sm, struct eap_pwd_data *data,
 	u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr;
 	int offset;
 
+	if (payload_len != SHA256_MAC_LEN) {
+		wpa_printf(MSG_INFO,
+			   "EAP-pwd: Unexpected Confirm payload length %u (expected %u)",
+			   (unsigned int) payload_len, SHA256_MAC_LEN);
+		goto fin;
+	}
+
 	/* build up the ciphersuite: group | random_function | prf */
 	grp = htons(data->group_num);
 	ptr = (u8 *) &cs;
--- 
1.9.1

diff --git a/main/wpa_supplicant/0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch b/main/wpa_supplicant/0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch
deleted file mode 100644
index 4d2f9d8..0000000
--- a/main/wpa_supplicant/0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch
@@ -1,52 +0,0 @@
From 477c74395acd0123340457ba6f15ab345d42016e Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Sat, 2 May 2015 19:23:04 +0300
Subject: [PATCH 3/5] EAP-pwd peer: Fix Total-Length parsing for fragment
 reassembly

The remaining number of bytes in the message could be smaller than the
Total-Length field size, so the length needs to be explicitly checked
prior to reading the field and decrementing the len variable. This could
have resulted in the remaining length becoming negative and interpreted
as a huge positive integer.

In addition, check that there is no already started fragment in progress
before allocating a new buffer for reassembling fragments. This avoid a
potential memory leak when processing invalid message.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/eap_peer/eap_pwd.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
index a629437..1d2079b 100644
--- a/src/eap_peer/eap_pwd.c
+++ b/src/eap_peer/eap_pwd.c
@@ -866,11 +866,23 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
 	 * if it's the first fragment there'll be a length field
 	 */
 	if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {
+		if (len < 2) {
+			wpa_printf(MSG_DEBUG,
+				   "EAP-pwd: Frame too short to contain Total-Length field");
+			ret->ignore = TRUE;
+			return NULL;
+		}
 		tot_len = WPA_GET_BE16(pos);
 		wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments whose "
 			   "total length = %d", tot_len);
 		if (tot_len > 15000)
 			return NULL;
+		if (data->inbuf) {
+			wpa_printf(MSG_DEBUG,
+				   "EAP-pwd: Unexpected new fragment start when previous fragment is still in use");
+			ret->ignore = TRUE;
+			return NULL;
+		}
 		data->inbuf = wpabuf_alloc(tot_len);
 		if (data->inbuf == NULL) {
 			wpa_printf(MSG_INFO, "Out of memory to buffer "
--- 
1.9.1

diff --git a/main/wpa_supplicant/0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch b/main/wpa_supplicant/0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch
deleted file mode 100644
index 7edef09..0000000
--- a/main/wpa_supplicant/0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch
@@ -1,50 +0,0 @@
From 3035cc2894e08319b905bd6561e8bddc8c2db9fa Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Sat, 2 May 2015 19:26:06 +0300
Subject: [PATCH 4/5] EAP-pwd server: Fix Total-Length parsing for fragment
 reassembly

The remaining number of bytes in the message could be smaller than the
Total-Length field size, so the length needs to be explicitly checked
prior to reading the field and decrementing the len variable. This could
have resulted in the remaining length becoming negative and interpreted
as a huge positive integer.

In addition, check that there is no already started fragment in progress
before allocating a new buffer for reassembling fragments. This avoid a
potential memory leak when processing invalid message.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/eap_server/eap_server_pwd.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/eap_server/eap_server_pwd.c b/src/eap_server/eap_server_pwd.c
index 3189105..2bfc3c2 100644
--- a/src/eap_server/eap_server_pwd.c
+++ b/src/eap_server/eap_server_pwd.c
@@ -942,11 +942,21 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv,
 	 * the first fragment has a total length
 	 */
 	if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {
+		if (len < 2) {
+			wpa_printf(MSG_DEBUG,
+				   "EAP-pwd: Frame too short to contain Total-Length field");
+			return;
+		}
 		tot_len = WPA_GET_BE16(pos);
 		wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments, total "
 			   "length = %d", tot_len);
 		if (tot_len > 15000)
 			return;
+		if (data->inbuf) {
+			wpa_printf(MSG_DEBUG,
+				   "EAP-pwd: Unexpected new fragment start when previous fragment is still in use");
+			return;
+		}
 		data->inbuf = wpabuf_alloc(tot_len);
 		if (data->inbuf == NULL) {
 			wpa_printf(MSG_INFO, "EAP-pwd: Out of memory to "
--- 
1.9.1

diff --git a/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch b/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch
deleted file mode 100644
index a601323..0000000
--- a/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch
@@ -1,32 +0,0 @@
From 28a069a545b06b99eb55ad53f63f2c99e65a98f6 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Sat, 2 May 2015 19:26:28 +0300
Subject: [PATCH 5/5] EAP-pwd peer: Fix asymmetric fragmentation behavior

The L (Length) and M (More) flags needs to be cleared before deciding
whether the locally generated response requires fragmentation. This
fixes an issue where these flags from the server could have been invalid
for the following message. In some cases, this could have resulted in
triggering the wpabuf security check that would terminate the process
due to invalid buffer allocation.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/eap_peer/eap_pwd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
index 1d2079b..e58b13a 100644
--- a/src/eap_peer/eap_pwd.c
+++ b/src/eap_peer/eap_pwd.c
@@ -968,6 +968,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
 	/*
 	 * we have output! Do we need to fragment it?
 	 */
+	lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch);
 	len = wpabuf_len(data->outbuf);
 	if ((len + EAP_PWD_HDR_SIZE) > data->mtu) {
 		resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu,
--- 
1.9.1

diff --git a/main/wpa_supplicant/APKBUILD b/main/wpa_supplicant/APKBUILD
index 781c07c..5a08ac6 100644
--- a/main/wpa_supplicant/APKBUILD
+++ b/main/wpa_supplicant/APKBUILD
@@ -1,8 +1,8 @@
# Contributor: Sören Tempel <soeren+alpine@soeren-tempel.net>
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=wpa_supplicant
pkgver=2.4
pkgrel=8
pkgver=2.5
pkgrel=0
pkgdesc="A utility providing key negotiation for WPA wireless networks"
url="https://w1.fi/wpa_supplicant/"
arch="all"
@@ -11,15 +11,6 @@ subpackages="$pkgname-doc $pkgname-gui"
depends="dbus"
makedepends="openssl-dev dbus-dev libnl3-dev qt-dev pcsc-lite-dev"
source="http://w1.fi/releases/$pkgname-$pkgver.tar.gz
	CVE-2015-1863.patch
	CVE-2015-4141.patch
	CVE-2015-4142.patch
	0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch
	0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch
	0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch
	0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch
	0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch

	wpa_supplicant.initd
	wpa_supplicant.confd

@@ -88,42 +79,18 @@ gui() {
	mv "$pkgdir"/usr/bin/wpa_gui "$subpkgdir"/usr/bin/
}

md5sums="f0037dbe03897dcaf2ad2722e659095d  wpa_supplicant-2.4.tar.gz
8e8c34267fefcc4142ee142e5515b5df  CVE-2015-1863.patch
222ec96a8dc73c41608cc463beac3966  CVE-2015-4141.patch
d3688697f81ca1e684a79dfa3682a111  CVE-2015-4142.patch
87d611a9b704402f66fa59ba1458928d  0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch
bafcec421e4f5c6a8383893d029a79e5  0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch
fa2aed3cf49f7e6c7b17bf9db9a001f5  0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch
de0fca4d74a1883d15ef5754f13a5226  0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch
9d854969af23b207f9f3dff38ef78770  0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch
md5sums="96ff75c3a514f1f324560a2376f13110  wpa_supplicant-2.5.tar.gz
a8da41f58b8b4779d666ab7bd8233c18  wpa_supplicant.initd
bc117427f2c538439f3f1481a028ee06  wpa_supplicant.confd
b461dfd45a3bb9a4efde08abf32f4f82  config
4e3dea6c543b6d296e0b5123d5608499  config
707c26fbf3fa46a6410732efa7128eee  wpa_cli.sh"
sha256sums="058dc832c096139a059e6df814080f50251a8d313c21b13364c54a1e70109122  wpa_supplicant-2.4.tar.gz
a3abf75801f02199ff48c316a7b6598860e6ca20ce2fe79b0bec873905e5c8a4  CVE-2015-1863.patch
eb63d845fdc38b6310c527ad1705b6fe3b74f90e263188da2aca97468cc55142  CVE-2015-4141.patch
cc6c488afab4ccfdaedd9e224989b5fe713d6b0415ea94579190bd8ba60c9be5  CVE-2015-4142.patch
a204bc37f52e5346780a306c01706689eb46263dedcdcb1eb2f4c0b291a0db93  0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch
298fc3b89f987922fb2600d0c95e8c868d6da30d24643748afd47bcd30da7b44  0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch
2fd42fb53be793c54343aa18a84afebe4603aa6ce8b6969ad6b3a8d327c6b142  0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch
c28ca6303a562809dfd1812f9b918808b3b0f0c52cc43070fd1777e1cfc88f18  0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch
04ef66fbd5b2167274cd7123d7f7252963b9a9c1ec2f5edf6558a6ad92d47689  0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch
sha256sums="cce55bae483b364eae55c35ba567c279be442ed8bab5b80a3c7fb0d057b9b316  wpa_supplicant-2.5.tar.gz
5d6ee43b7752d15013fb31298087e9d82caa2568064e59e6ed6230d7de403867  wpa_supplicant.initd
61ec59007f66ac5bacc0aa095d1f2ccbc977a687038e161a463d1727223d5a90  wpa_supplicant.confd
0a3b037afdb0c7af94c135dc7518451b6a2e53214ca7381d6f7c6f0f2cf4953a  config
0811f6315663b9cf9e5218e7a8ac96d0145e20055a56fff05cd1973aace5e41d  config
dec1d357d8db5067bdba39a300760b06667a6d1b59f15fdb93063d61bf11b596  wpa_cli.sh"
sha512sums="03d8199325b3910f77013ddb7edd803ab4444542230484e1cb465dc3df9372b39ee3307d823ce88730e8f5a5231ef3183954c54cf07297b70432f526e45aac2b  wpa_supplicant-2.4.tar.gz
61f90d06bd42fb7ea17ba147db861303f5b1fdce2cda35492cec578214da5ea5d654a1df99dee4d4a0c07ef3e8b3bfb65ab4b98eff21c2013adf536766136ce1  CVE-2015-1863.patch
4633a96a91e151407e4c62b74b4e78d37e4fba586278c6ae4340ce149bee0c644a4d62675256839c3130374a4dc7531beaeed8282946e7dcd3faf1ed74bf99be  CVE-2015-4141.patch
dc561d90f3f329ebb201abbb53eea161603fb2abba6b2fc5c79298d97c84f2d65d401608cd7bb2fb82abf909661c56699bf4bcbf902f6f8c7d5b1853b0277353  CVE-2015-4142.patch
9440f8d9d18d20b95d236c1a4467d86dfbbc17d8f26b0caa48d6737c6231d1ff14793c6fc8a1e4508f3ad38c9a5d710fd49b85c7de16634dbe6685af05f44f7c  0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch
0887017bfdb4632baa49bb849b732eed7eec9a498247fdd5ef8448e4a6df10380c06d68fa706e0b2624c04eb6f5a327cdb71c5c71c3476dc383f889ee7372702  0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch
341901aa94c44ae725b6d4dddac2a52b6457234189554fc282c9cf5fa0254125d7323553a7b8118f9a3e2020f039267ed4c912f84ac6f2cb12670b40c28ac652  0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch
b752f91c3d6dcf0784d9cb20a0c7f8de6c837c38ff62cf77b136d9b818890b13f55eeed1d6097f244181b480be953e1bdfb5651116dc5d62a2d02c018e19042a  0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch
07a21f0cc7d00e17bed8ef5ced36159020a410a4606aa0ca24e47223835ab0cc5fbeed3075c4f17d2ce1aee437eedf9fea8f4b95252b2fa255d54a195637cb6f  0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch
sha512sums="e3ca36ed10b4dae8f663e98ad230c8c059c952316c21a6b0638ecb1b40a5ef1b9083138ab45207cb764a17e870b4bd0625dd6efdb65856cb4dca13ccc0559e81  wpa_supplicant-2.5.tar.gz
cfe9de2813d5ec778c7f5cb404c23aad371dee9922dea172358a8ea95ab4e5dd01a3b9fc1a452dd3c3c9a2f02e8b12ffe162b69767f95faa18480fb79499301b  wpa_supplicant.initd
29103161ec2b9631fca9e8d9a97fafd60ffac3fe78cf613b834395ddcaf8be1e253c22e060d7d9f9b974b2d7ce794caa932a2125e29f6494b75bce475f7b30e1  wpa_supplicant.confd
bf66c0f49437f0bd6c04b3520cb27e64086a24e01bee7a679d1a713d7907c6b15ff68631749204a386bb70581f571c7eb0afd19dbca89054d868a732c16fed6b  config
5eeb7308ea1a89f4bc015c2e8baf9ee30bb08c550b3f36729fac6ad82acb9faed15b99a6fb5864acd4b186625232c435f2d65e44f60324f6d2280a7cc49e2861  config
44d33cfe419cdb65cc14f2ac05aa9f8a1b9f2f432181e498071e41ef835662db1e4c5142adf4cfab2475e7b606696169936bd159d1d711f803322db93f242361  wpa_cli.sh"
diff --git a/main/wpa_supplicant/CVE-2015-1863.patch b/main/wpa_supplicant/CVE-2015-1863.patch
deleted file mode 100644
index de1964c..0000000
--- a/main/wpa_supplicant/CVE-2015-1863.patch
@@ -1,42 +0,0 @@
From 9ed4eee345f85e3025c33c6e20aa25696e341ccd Mon Sep 17 00:00:00 2001
From: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Tue, 7 Apr 2015 11:32:11 +0300
Subject: [PATCH] P2P: Validate SSID element length before copying it
 (CVE-2015-1863)

This fixes a possible memcpy overflow for P2P dev->oper_ssid in
p2p_add_device(). The length provided by the peer device (0..255 bytes)
was used without proper bounds checking and that could have resulted in
arbitrary data of up to 223 bytes being written beyond the end of the
dev->oper_ssid[] array (of which about 150 bytes would be beyond the
heap allocation) when processing a corrupted management frame for P2P
peer discovery purposes.

This could result in corrupted state in heap, unexpected program
behavior due to corrupted P2P peer device information, denial of service
due to process crash, exposure of memory contents during GO Negotiation,
and potentially arbitrary code execution.

Thanks to Google security team for reporting this issue and smart
hardware research group of Alibaba security team for discovering it.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
---
 src/p2p/p2p.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
index f584fae..a45fe73 100644
--- a/src/p2p/p2p.c
+++ b/src/p2p/p2p.c
@@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq,
 	if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
 		os_memcpy(dev->interface_addr, addr, ETH_ALEN);
 	if (msg.ssid &&
+	    msg.ssid[1] <= sizeof(dev->oper_ssid) &&
 	    (msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
 	     os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
 	     != 0)) {
--- 
1.9.1

diff --git a/main/wpa_supplicant/CVE-2015-4141.patch b/main/wpa_supplicant/CVE-2015-4141.patch
deleted file mode 100644
index 36b4ca2..0000000
--- a/main/wpa_supplicant/CVE-2015-4141.patch
@@ -1,49 +0,0 @@
From 5acd23f4581da58683f3cf5e36cb71bbe4070bd7 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Tue, 28 Apr 2015 17:08:33 +0300
Subject: [PATCH] WPS: Fix HTTP chunked transfer encoding parser

strtoul() return value may end up overflowing the int h->chunk_size and
resulting in a negative value to be stored as the chunk_size. This could
result in the following memcpy operation using a very large length
argument which would result in a buffer overflow and segmentation fault.

This could have been used to cause a denial service by any device that
has been authorized for network access (either wireless or wired). This
would affect both the WPS UPnP functionality in a WPS AP (hostapd with
upnp_iface parameter set in the configuration) and WPS ER
(wpa_supplicant with WPS_ER_START control interface command used).

Validate the parsed chunk length value to avoid this. In addition to
rejecting negative values, we can also reject chunk size that would be
larger than the maximum configured body length.

Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/wps/httpread.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/wps/httpread.c b/src/wps/httpread.c
index 2f08f37..d2855e3 100644
--- a/src/wps/httpread.c
+++ b/src/wps/httpread.c
@@ -533,6 +533,13 @@ static void httpread_read_handler(int sd, void *eloop_ctx, void *sock_ctx)
 					if (!isxdigit(*cbp))
 						goto bad;
 					h->chunk_size = strtoul(cbp, NULL, 16);
+					if (h->chunk_size < 0 ||
+					    h->chunk_size > h->max_bytes) {
+						wpa_printf(MSG_DEBUG,
+							   "httpread: Invalid chunk size %d",
+							   h->chunk_size);
+						goto bad;
+					}
 					/* throw away chunk header
 					 * so we have only real data
 					 */
--- 
1.9.1

diff --git a/main/wpa_supplicant/CVE-2015-4142.patch b/main/wpa_supplicant/CVE-2015-4142.patch
deleted file mode 100644
index 79c5af8..0000000
--- a/main/wpa_supplicant/CVE-2015-4142.patch
@@ -1,41 +0,0 @@
From ef566a4d4f74022e1fdb0a2addfe81e6de9f4aae Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Wed, 29 Apr 2015 02:21:53 +0300
Subject: [PATCH] AP WMM: Fix integer underflow in WMM Action frame parser

The length of the WMM Action frame was not properly validated and the
length of the information elements (int left) could end up being
negative. This would result in reading significantly past the stack
buffer while parsing the IEs in ieee802_11_parse_elems() and while doing
so, resulting in segmentation fault.

This can result in an invalid frame being used for a denial of service
attack (hostapd process killed) against an AP with a driver that uses
hostapd for management frame processing (e.g., all mac80211-based
drivers).

Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 src/ap/wmm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/ap/wmm.c b/src/ap/wmm.c
index 6d4177c..314e244 100644
--- a/src/ap/wmm.c
+++ b/src/ap/wmm.c
@@ -274,6 +274,9 @@ void hostapd_wmm_action(struct hostapd_data *hapd,
 		return;
 	}
 
+	if (left < 0)
+		return; /* not a valid WMM Action frame */
+
 	/* extract the tspec info element */
 	if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) {
 		hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
--- 
1.9.1

diff --git a/main/wpa_supplicant/config b/main/wpa_supplicant/config
index 701c073..eb40831 100644
--- a/main/wpa_supplicant/config
+++ b/main/wpa_supplicant/config
@@ -495,3 +495,12 @@ CONFIG_P2P=y
#
# External password backend for testing purposes (developer use)
#CONFIG_EXT_PASSWORD_TEST=y

# Enable Fast Session Transfer (FST)
#CONFIG_FST=y

# Enable CLI commands for FST testing
#CONFIG_FST_TEST=y

# OS X builds. This is only for building eapol_test.
#CONFIG_OSX=y
-- 
2.6.1



---
Unsubscribe:  alpine-aports+unsubscribe@lists.alpinelinux.org
Help:         alpine-aports+help@lists.alpinelinux.org
---
Reply to thread Export thread (mbox)