[openwrt/openwrt] hostapd: fix SAE H2E security vulnerability
LEDE Commits
lede-commits at lists.infradead.org
Fri Aug 2 14:19:35 PDT 2024
hauke pushed a commit to openwrt/openwrt.git, branch openwrt-23.05:
https://git.openwrt.org/e4625c37c4844c63a6f3b843e9a137ea41fd0844
commit e4625c37c4844c63a6f3b843e9a137ea41fd0844
Author: Rany Hany <rany_hany at riseup.net>
AuthorDate: Wed Jul 31 17:16:55 2024 +0000
hostapd: fix SAE H2E security vulnerability
This patch backports fixes for a security vulnerability impacting the
hostapd implementation of SAE H2E.
As upgrading hostapd would require more testing, the second mitigation
step which involves backporting several patches was adopted as outlined
in the official advisory[1].
An explanation of the impact of the vulnerability is provided from the
advisory[1]:
This vulnerability allows the attacker to downgrade the negotiated group
to another enabled group if both the AP and STA have enabled SAE H2E and
multiple groups. It should be noted that the H2E option is not enabled
by default and the attack is not applicable to the default option, i.e.,
hunting-and-pecking, since it does not have any downgrade protection for
group negotiation. In addition, the default configuration for enabled
SAE groups in hostapd is to enable only a single group, so the
vulnerability is not applicable unless hostapd has been explicitly
configured to enable more groups for SAE.
[1]: https://w1.fi/security/2024-2/sae-h2h-and-incomplete-downgrade-protection-for-group-negotiation.txt
Signed-off-by: Rany Hany <rany_hany at riseup.net>
Link: https://github.com/openwrt/openwrt/pull/16043
Signed-off-by: Hauke Mehrtens <hauke at hauke-m.de>
(cherry picked from commit db7f70fe6140e99ae709c7bf2a25eb983cb725ed)
---
package/network/services/hostapd/Makefile | 2 +-
...or-invalid-Rejected-Groups-element-length.patch | 43 ++++++++++++++++++++++
...or-invalid-Rejected-Groups-element-length.patch | 42 +++++++++++++++++++++
...invalid-Rejected-Groups-element-in-the-pa.patch | 30 +++++++++++++++
4 files changed, 116 insertions(+), 1 deletion(-)
diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile
index 048cdce98e..28b7f4490e 100644
--- a/package/network/services/hostapd/Makefile
+++ b/package/network/services/hostapd/Makefile
@@ -5,7 +5,7 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=hostapd
-PKG_RELEASE:=7
+PKG_RELEASE:=8
PKG_SOURCE_URL:=http://w1.fi/hostap.git
PKG_SOURCE_PROTO:=git
diff --git a/package/network/services/hostapd/patches/800-SAE-Check-for-invalid-Rejected-Groups-element-length.patch b/package/network/services/hostapd/patches/800-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
new file mode 100644
index 0000000000..9331aa5826
--- /dev/null
+++ b/package/network/services/hostapd/patches/800-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
@@ -0,0 +1,43 @@
+From 364c2da8741f0979dae497551e70b94c0e6c8636 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j at w1.fi>
+Date: Sun, 7 Jul 2024 11:46:49 +0300
+Subject: [PATCH] SAE: Check for invalid Rejected Groups element length
+ explicitly
+
+Instead of practically ignoring an odd octet at the end of the element,
+check for such invalid case explicitly. This is needed to avoid a
+potential group downgrade attack.
+
+Signed-off-by: Jouni Malinen <j at w1.fi>
+---
+ src/ap/ieee802_11.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -1223,7 +1223,7 @@ static int check_sae_rejected_groups(str
+ struct sae_data *sae)
+ {
+ const struct wpabuf *groups;
+- size_t i, count;
++ size_t i, count, len;
+ const u8 *pos;
+
+ if (!sae->tmp)
+@@ -1233,7 +1233,15 @@ static int check_sae_rejected_groups(str
+ return 0;
+
+ pos = wpabuf_head(groups);
+- count = wpabuf_len(groups) / 2;
++ len = wpabuf_len(groups);
++ if (len & 1) {
++ wpa_printf(MSG_DEBUG,
++ "SAE: Invalid length of the Rejected Groups element payload: %zu",
++ len);
++ return 1;
++ }
++
++ count = len / 2;
+ for (i = 0; i < count; i++) {
+ int enabled;
+ u16 group;
diff --git a/package/network/services/hostapd/patches/801-SAE-Check-for-invalid-Rejected-Groups-element-length.patch b/package/network/services/hostapd/patches/801-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
new file mode 100644
index 0000000000..a6e7628b91
--- /dev/null
+++ b/package/network/services/hostapd/patches/801-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
@@ -0,0 +1,42 @@
+From 593a7c2f8c93edd6b552f2d42e28164464b4e6ff Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j at w1.fi>
+Date: Tue, 9 Jul 2024 23:33:38 +0300
+Subject: [PATCH] SAE: Check for invalid Rejected Groups element length
+ explicitly on STA
+
+Instead of practically ignoring an odd octet at the end of the element,
+check for such invalid case explicitly. This is needed to avoid a
+potential group downgrade attack.
+
+Fixes: 444d76f74f65 ("SAE: Check that peer's rejected groups are not enabled")
+Signed-off-by: Jouni Malinen <j at w1.fi>
+---
+ wpa_supplicant/sme.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/wpa_supplicant/sme.c
++++ b/wpa_supplicant/sme.c
+@@ -1596,14 +1596,21 @@ static int sme_sae_is_group_enabled(stru
+ static int sme_check_sae_rejected_groups(struct wpa_supplicant *wpa_s,
+ const struct wpabuf *groups)
+ {
+- size_t i, count;
++ size_t i, count, len;
+ const u8 *pos;
+
+ if (!groups)
+ return 0;
+
+ pos = wpabuf_head(groups);
+- count = wpabuf_len(groups) / 2;
++ len = wpabuf_len(groups);
++ if (len & 1) {
++ wpa_printf(MSG_DEBUG,
++ "SAE: Invalid length of the Rejected Groups element payload: %zu",
++ len);
++ return 1;
++ }
++ count = len / 2;
+ for (i = 0; i < count; i++) {
+ int enabled;
+ u16 group;
diff --git a/package/network/services/hostapd/patches/802-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch b/package/network/services/hostapd/patches/802-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch
new file mode 100644
index 0000000000..572a3f721f
--- /dev/null
+++ b/package/network/services/hostapd/patches/802-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch
@@ -0,0 +1,30 @@
+From 9716bf1160beb677e965d9e6475d6c9e162e8374 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j at w1.fi>
+Date: Tue, 9 Jul 2024 23:34:34 +0300
+Subject: [PATCH] SAE: Reject invalid Rejected Groups element in the parser
+
+There is no need to depend on all uses (i.e., both hostapd and
+wpa_supplicant) to verify that the length of the Rejected Groups field
+in the Rejected Groups element is valid (i.e., a multiple of two octets)
+since the common parser can reject the message when detecting this.
+
+Signed-off-by: Jouni Malinen <j at w1.fi>
+---
+ src/common/sae.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/src/common/sae.c
++++ b/src/common/sae.c
+@@ -2120,6 +2120,12 @@ static int sae_parse_rejected_groups(str
+ return WLAN_STATUS_UNSPECIFIED_FAILURE;
+ epos++; /* skip ext ID */
+ len--;
++ if (len & 1) {
++ wpa_printf(MSG_DEBUG,
++ "SAE: Invalid length of the Rejected Groups element payload: %u",
++ len);
++ return WLAN_STATUS_UNSPECIFIED_FAILURE;
++ }
+
+ wpabuf_free(sae->tmp->peer_rejected_groups);
+ sae->tmp->peer_rejected_groups = wpabuf_alloc(len);
More information about the lede-commits
mailing list