wpa_supplicant P2P group information processing vulnerability

[Jouni Malinen]

Published: February 4, 2021
Latest version available from: https://w1.fi/security/2020-2/


Vulnerability

A vulnerability was discovered in how wpa_supplicant processing P2P
(Wi-Fi Direct) group information from active group owners. The actual
parsing of that information validates field lengths appropriately, but
processing of the parsed information misses a length check when storing
a copy of the secondary device types. This can result in writing
attacker controlled data into the peer entry after the area assigned for
the secondary device type. The overflow can result in corrupting
pointers for heap allocations. This can result in an attacker within
radio range of the device running P2P discovery being able to cause
unexpected behavior, including termination of the wpa_supplicant process
and potentially arbitrary code execution.


Vulnerable versions/configurations

wpa_supplicant v1.0-v2.9 with CONFIG_P2P build option enabled

An attacker (or a system controlled by the attacker) needs to be within
radio range of the vulnerable system to send a suitably constructed
management frame that triggers a P2P peer device information to be
created or updated.


Acknowledgments

This issue was discovered by fuzz testing of wpa_supplicant by Google's
OSS-Fuzz.

Possible mitigation steps

- Merge the following commit to wpa_supplicant and rebuild it:

  P2P: Fix copying of secondary device types for P2P group client
  
  This patch is available from https://w1.fi/security/2020-2/
  
- Update to wpa_supplicant v2.10 or newer, once available

- Disable P2P (control interface command "P2P_SET disabled 1" or
  "p2p_disabled=1" in (each, if multiple interfaces used) wpa_supplicant
  configuration file)

- Disable P2P from the build (remove CONFIG_P2P=y)

-- 
Jouni Malinen                                            PGP id EFC895FA