diff options
author | Hauke Mehrtens <hauke@hauke-m.de> | 2019-05-17 23:22:02 +0200 |
---|---|---|
committer | Hauke Mehrtens <hauke@hauke-m.de> | 2019-06-21 10:29:23 +0200 |
commit | b463a13881d3699c0f2d67ceeda146c76af58ac6 (patch) | |
tree | 117e73afb22cfa753cdc076a063ae22cd33fb194 /package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch | |
parent | fc1dae5be797f54d45f5a61ae17fe548e108dd0d (diff) | |
download | upstream-b463a13881d3699c0f2d67ceeda146c76af58ac6.tar.gz upstream-b463a13881d3699c0f2d67ceeda146c76af58ac6.tar.bz2 upstream-b463a13881d3699c0f2d67ceeda146c76af58ac6.zip |
hostapd: fix multiple security problems
This fixes the following security problems:
* CVE-2019-9494: cache attack against SAE
* CVE-2019-9495: cache attack against EAP-pwd
* CVE-2019-9496: SAE confirm missing state validation in hostapd/AP
* CVE-2019-9497: EAP-pwd server not checking for reflection attack)
* CVE-2019-9498: EAP-pwd server missing commit validation for scalar/element
* CVE-2019-9499: EAP-pwd peer missing commit validation for scalar/element
* CVE-2019-11555: EAP-pwd message reassembly issue with unexpected fragment
Most of these problems are not relevant for normal users, SAE is only
used in ieee80211s mesh mode and EAP-pwd is normally not activated.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Diffstat (limited to 'package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch')
-rw-r--r-- | package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch | 53 |
1 files changed, 53 insertions, 0 deletions
diff --git a/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch b/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch new file mode 100644 index 0000000000..5e0d0d2078 --- /dev/null +++ b/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch @@ -0,0 +1,53 @@ +From 70ff850e89fbc8bc7da515321b4d15b5eef70581 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <mathy.vanhoef@nyu.edu> +Date: Sun, 31 Mar 2019 17:13:06 +0200 +Subject: [PATCH 11/14] EAP-pwd server: Verify received scalar and element + +When processing an EAP-pwd Commit frame, the peer's scalar and element +(elliptic curve point) were not validated. This allowed an adversary to +bypass authentication, and impersonate any user if the crypto +implementation did not verify the validity of the EC point. + +Fix this vulnerability by assuring the received scalar lies within the +valid range, and by checking that the received element is not the point +at infinity and lies on the elliptic curve being used. (CVE-2019-9498) + +The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower +is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL +(and also BoringSSL) implicitly validate the elliptic curve point in +EC_POINT_set_affine_coordinates_GFp(), preventing the attack. + +Signed-off-by: Mathy Vanhoef <mathy.vanhoef@nyu.edu> +--- + src/eap_server/eap_server_pwd.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/src/eap_server/eap_server_pwd.c ++++ b/src/eap_server/eap_server_pwd.c +@@ -653,6 +653,26 @@ eap_pwd_process_commit_resp(struct eap_s + goto fin; + } + ++ /* verify received scalar */ ++ if (crypto_bignum_is_zero(data->peer_scalar) || ++ crypto_bignum_is_one(data->peer_scalar) || ++ crypto_bignum_cmp(data->peer_scalar, ++ crypto_ec_get_order(data->grp->group)) >= 0) { ++ wpa_printf(MSG_INFO, ++ "EAP-PWD (server): received scalar is invalid"); ++ goto fin; ++ } ++ ++ /* verify received element */ ++ if (!crypto_ec_point_is_on_curve(data->grp->group, ++ data->peer_element) || ++ crypto_ec_point_is_at_infinity(data->grp->group, ++ data->peer_element)) { ++ wpa_printf(MSG_INFO, ++ "EAP-PWD (server): received element is invalid"); ++ goto fin; ++ } ++ + /* check to ensure peer's element is not in a small sub-group */ + if (!crypto_bignum_is_one(cofactor)) { + if (crypto_ec_point_mul(data->grp->group, data->peer_element, |