linville pushed to hostapd (f21). "apply fix for underflow in WMM action frame parser"
notifications at fedoraproject.org
notifications at fedoraproject.org
Fri May 15 18:23:36 UTC 2015
From e7af6e81341a755d572d0ca5d77c7aef287a5b9e Mon Sep 17 00:00:00 2001
From: "John W. Linville" <linville at tuxdriver.com>
Date: Fri, 15 May 2015 13:53:08 -0400
Subject: apply fix for underflow in WMM action frame parser
diff --git a/hostapd-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch b/hostapd-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch
new file mode 100644
index 0000000..79c5af8
--- /dev/null
+++ b/hostapd-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch
@@ -0,0 +1,41 @@
+From ef566a4d4f74022e1fdb0a2addfe81e6de9f4aae Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j at w1.fi>
+Date: Wed, 29 Apr 2015 02:21:53 +0300
+Subject: [PATCH] AP WMM: Fix integer underflow in WMM Action frame parser
+
+The length of the WMM Action frame was not properly validated and the
+length of the information elements (int left) could end up being
+negative. This would result in reading significantly past the stack
+buffer while parsing the IEs in ieee802_11_parse_elems() and while doing
+so, resulting in segmentation fault.
+
+This can result in an invalid frame being used for a denial of service
+attack (hostapd process killed) against an AP with a driver that uses
+hostapd for management frame processing (e.g., all mac80211-based
+drivers).
+
+Thanks to Kostya Kortchinsky of Google security team for discovering and
+reporting this issue.
+
+Signed-off-by: Jouni Malinen <j at w1.fi>
+---
+ src/ap/wmm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/ap/wmm.c b/src/ap/wmm.c
+index 6d4177c..314e244 100644
+--- a/src/ap/wmm.c
++++ b/src/ap/wmm.c
+@@ -274,6 +274,9 @@ void hostapd_wmm_action(struct hostapd_data *hapd,
+ return;
+ }
+
++ if (left < 0)
++ return; /* not a valid WMM Action frame */
++
+ /* extract the tspec info element */
+ if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) {
+ hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
+--
+1.9.1
+
diff --git a/hostapd.spec b/hostapd.spec
index b6d301a..f42ae5d 100644
--- a/hostapd.spec
+++ b/hostapd.spec
@@ -2,7 +2,7 @@
Name: hostapd
Version: 2.4
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: IEEE 802.11 AP, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
License: BSD
URL: http://w1.fi/hostapd
@@ -13,6 +13,7 @@ Source2: %{name}.conf
Source3: %{name}.sysconfig
Source4: %{name}.init
Patch0: %{name}-EAP-TLS-server-Fix-TLS-Message-Length-validation.patch
+Patch1: %{name}-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch
BuildRequires: libnl3-devel
BuildRequires: openssl-devel
@@ -54,6 +55,8 @@ Logwatch scripts for hostapd.
# git://w1.fi/srv/git/hostap.git
# commit 586c446e0ff42ae00315b014924ec669023bd8de
%patch0 -p1 -b .message_length
+# commit ef566a4d4f74022e1fdb0a2addfe81e6de9f4aae
+%patch1 -p1 -b .wmm_underflow
%build
cd hostapd
@@ -172,6 +175,9 @@ fi
%{_sysconfdir}/logwatch/scripts/services/%{name}
%changelog
+* Fri May 15 2015 John W. Linville <linville at redhat.com> - 2.4-2
+- apply fix for underflow in WMM action frame parser
+
* Tue Apr 21 2015 John W. Linville <linville at redhat.com> - 2.4-1
- Update to version 2.4 from upstream
- Enable support for IEEE802.11r and IEEE802.11ac
--
cgit v0.10.2
http://pkgs.fedoraproject.org/cgit/hostapd.git/commit/?h=f21&id=e7af6e81341a755d572d0ca5d77c7aef287a5b9e
More information about the scm-commits
mailing list