Hello community, here is the log from the commit of package wpa_supplicant for openSUSE:Factory checked in at 2015-05-10 10:56:17 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wpa_supplicant (Old) and /work/SRC/openSUSE:Factory/.wpa_supplicant.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "wpa_supplicant" Changes: -------- --- /work/SRC/openSUSE:Factory/wpa_supplicant/wpa_supplicant.changes 2015-05-06 07:46:44.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.wpa_supplicant.new/wpa_supplicant.changes 2015-05-10 10:56:19.000000000 +0200 @@ -1,0 +2,14 @@ +Thu May 7 17:18:29 CEST 2015 - ro@suse.de + +- added patch for bnc#930077 + 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch +- added patch for bnc#930078 + 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch +- added patches for bnc#930079 + 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch + 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch + 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch + 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch + 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch + +------------------------------------------------------------------- New: ---- 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wpa_supplicant.spec ++++++ --- /var/tmp/diff_new_pack.KZKhqV/_old 2015-05-10 10:56:20.000000000 +0200 +++ /var/tmp/diff_new_pack.KZKhqV/_new 2015-05-10 10:56:20.000000000 +0200 @@ -51,6 +51,21 @@ Patch4: wpa_supplicant-alloc_size.patch # PATCH-FIX-UPSTREAM wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch arch#44740 zaitor@opensuse.org -- Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git. Patch5: wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch +# PATCH-FIX-UPSTREAM 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch bnc#930077 +Patch6: 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch +# PATCH-FIX-UPSTREAM 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch bnc#930078 +Patch7: 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch +# PATCH-FIX-UPSTREAM 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch bnc#930079 +Patch8: 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch +# PATCH-FIX-UPSTREAM 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch bnc#930079 +Patch9: 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch +# PATCH-FIX-UPSTREAM 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch bnc#930079 +Patch10: 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch +# PATCH-FIX-UPSTREAM 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch bnc#930079 +Patch11: 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch +# PATCH-FIX-UPSTREAM 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch bnc#930079 +Patch12: 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch + BuildRoot: %{_tmppath}/%{name}-%{version}-build Requires: logrotate %if ! %{defined _rundir} @@ -91,6 +106,14 @@ %patch3 -p1 %patch4 -p1 %patch5 -p1 +%patch6 -p1 +%patch7 -p1 +%patch8 -p1 +%patch9 -p1 +%patch10 -p1 +%patch11 -p1 +%patch12 -p1 + %build cd wpa_supplicant CFLAGS="$RPM_OPT_FLAGS" make V=1 %{?_smp_mflags} ++++++ 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch ++++++
From ef566a4d4f74022e1fdb0a2addfe81e6de9f4aae Mon Sep 17 00:00:00 2001 From: Jouni Malinen
Date: Wed, 29 Apr 2015 02:21:53 +0300 Subject: [PATCH] AP WMM: Fix integer underflow in WMM Action frame parser
The length of the WMM Action frame was not properly validated and the
length of the information elements (int left) could end up being
negative. This would result in reading significantly past the stack
buffer while parsing the IEs in ieee802_11_parse_elems() and while doing
so, resulting in segmentation fault.
This can result in an invalid frame being used for a denial of service
attack (hostapd process killed) against an AP with a driver that uses
hostapd for management frame processing (e.g., all mac80211-based
drivers).
Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.
Signed-off-by: Jouni Malinen
From dd2f043c9c43d156494e33d7ce22db96e6ef42c7 Mon Sep 17 00:00:00 2001 From: Jouni Malinen
Date: Fri, 1 May 2015 16:37:45 +0300 Subject: [PATCH 1/5] EAP-pwd peer: Fix payload length validation for Commit and Confirm
The length of the received Commit and Confirm message payloads was not
checked before reading them. This could result in a buffer read
overflow when processing an invalid message.
Fix this by verifying that the payload is of expected length before
processing it. In addition, enforce correct state transition sequence to
make sure there is no unexpected behavior if receiving a Commit/Confirm
message before the previous exchanges have been completed.
Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.
Signed-off-by: Jouni Malinen
From 5acd23f4581da58683f3cf5e36cb71bbe4070bd7 Mon Sep 17 00:00:00 2001 From: Jouni Malinen
Date: Tue, 28 Apr 2015 17:08:33 +0300 Subject: [PATCH] WPS: Fix HTTP chunked transfer encoding parser
strtoul() return value may end up overflowing the int h->chunk_size and
resulting in a negative value to be stored as the chunk_size. This could
result in the following memcpy operation using a very large length
argument which would result in a buffer overflow and segmentation fault.
This could have been used to cause a denial service by any device that
has been authorized for network access (either wireless or wired). This
would affect both the WPS UPnP functionality in a WPS AP (hostapd with
upnp_iface parameter set in the configuration) and WPS ER
(wpa_supplicant with WPS_ER_START control interface command used).
Validate the parsed chunk length value to avoid this. In addition to
rejecting negative values, we can also reject chunk size that would be
larger than the maximum configured body length.
Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.
Signed-off-by: Jouni Malinen
From e28a58be26184c2a23f80b410e0997ef1bd5d578 Mon Sep 17 00:00:00 2001 From: Jouni Malinen
Date: Fri, 1 May 2015 16:40:44 +0300 Subject: [PATCH 2/5] EAP-pwd server: Fix payload length validation for Commit and Confirm
The length of the received Commit and Confirm message payloads was not
checked before reading them. This could result in a buffer read
overflow when processing an invalid message.
Fix this by verifying that the payload is of expected length before
processing it. In addition, enforce correct state transition sequence to
make sure there is no unexpected behavior if receiving a Commit/Confirm
message before the previous exchanges have been completed.
Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.
Signed-off-by: Jouni Malinen
From 477c74395acd0123340457ba6f15ab345d42016e Mon Sep 17 00:00:00 2001 From: Jouni Malinen
Date: Sat, 2 May 2015 19:23:04 +0300 Subject: [PATCH 3/5] EAP-pwd peer: Fix Total-Length parsing for fragment reassembly
The remaining number of bytes in the message could be smaller than the
Total-Length field size, so the length needs to be explicitly checked
prior to reading the field and decrementing the len variable. This could
have resulted in the remaining length becoming negative and interpreted
as a huge positive integer.
In addition, check that there is no already started fragment in progress
before allocating a new buffer for reassembling fragments. This avoid a
potential memory leak when processing invalid message.
Signed-off-by: Jouni Malinen
From 3035cc2894e08319b905bd6561e8bddc8c2db9fa Mon Sep 17 00:00:00 2001 From: Jouni Malinen
Date: Sat, 2 May 2015 19:26:06 +0300 Subject: [PATCH 4/5] EAP-pwd server: Fix Total-Length parsing for fragment reassembly
The remaining number of bytes in the message could be smaller than the
Total-Length field size, so the length needs to be explicitly checked
prior to reading the field and decrementing the len variable. This could
have resulted in the remaining length becoming negative and interpreted
as a huge positive integer.
In addition, check that there is no already started fragment in progress
before allocating a new buffer for reassembling fragments. This avoid a
potential memory leak when processing invalid message.
Signed-off-by: Jouni Malinen
From 28a069a545b06b99eb55ad53f63f2c99e65a98f6 Mon Sep 17 00:00:00 2001 From: Jouni Malinen
Date: Sat, 2 May 2015 19:26:28 +0300 Subject: [PATCH 5/5] EAP-pwd peer: Fix asymmetric fragmentation behavior
The L (Length) and M (More) flags needs to be cleared before deciding
whether the locally generated response requires fragmentation. This
fixes an issue where these flags from the server could have been invalid
for the following message. In some cases, this could have resulted in
triggering the wpabuf security check that would terminate the process
due to invalid buffer allocation.
Signed-off-by: Jouni Malinen