16accb6b24
- 264 license table entries with exact download URLs (224/264 resolved) - Complete sources/ directory with all BitBake recipes - Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl) - Full traceability for Softwarefreigabeantrag - GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4 - License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)
53 lines
1.5 KiB
Diff
53 lines
1.5 KiB
Diff
From 364c2da8741f0979dae497551e70b94c0e6c8636 Mon Sep 17 00:00:00 2001
|
|
From: Jouni Malinen <j@w1.fi>
|
|
Date: Sun, 7 Jul 2024 11:46:49 +0300
|
|
Subject: [PATCH 1/3] SAE: Check for invalid Rejected Groups element length
|
|
explicitly
|
|
|
|
Instead of practically ignoring an odd octet at the end of the element,
|
|
check for such invalid case explicitly. This is needed to avoid a
|
|
potential group downgrade attack.
|
|
|
|
Signed-off-by: Jouni Malinen <j@w1.fi>
|
|
|
|
CVE: CVE-2024-3596
|
|
Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=364c2da8741f0979dae497551e70b94c0e6c8636]
|
|
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
|
---
|
|
src/ap/ieee802_11.c | 12 ++++++++++--
|
|
1 file changed, 10 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
|
|
index db4104928..1a62e30cc 100644
|
|
--- a/src/ap/ieee802_11.c
|
|
+++ b/src/ap/ieee802_11.c
|
|
@@ -1258,7 +1258,7 @@ static int check_sae_rejected_groups(struct hostapd_data *hapd,
|
|
struct sae_data *sae)
|
|
{
|
|
const struct wpabuf *groups;
|
|
- size_t i, count;
|
|
+ size_t i, count, len;
|
|
const u8 *pos;
|
|
|
|
if (!sae->tmp)
|
|
@@ -1268,7 +1268,15 @@ static int check_sae_rejected_groups(struct hostapd_data *hapd,
|
|
return 0;
|
|
|
|
pos = wpabuf_head(groups);
|
|
- count = wpabuf_len(groups) / 2;
|
|
+ len = wpabuf_len(groups);
|
|
+ if (len & 1) {
|
|
+ wpa_printf(MSG_DEBUG,
|
|
+ "SAE: Invalid length of the Rejected Groups element payload: %zu",
|
|
+ len);
|
|
+ return 1;
|
|
+ }
|
|
+
|
|
+ count = len / 2;
|
|
for (i = 0; i < count; i++) {
|
|
int enabled;
|
|
u16 group;
|
|
--
|
|
2.30.2
|
|
|