From 45a2c0f3092deb5b1f4dee3117763e41201c3eee Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Fri, 20 Sep 2019 22:20:16 +0200 Subject: [PATCH] hostapd: Fix AP mode PMF disconnection protection bypass This fixes * CVE-2019-16275 AP mode PMF disconnection protection bypass https://w1.fi/security/2019-7/ap-mode-pmf-disconnection-protection-bypass.txt Signed-off-by: Hauke Mehrtens (cherry picked from commit a6981604b30bc1ddc1713b368fe853d89c2ba40d) --- package/network/services/hostapd/Makefile | 2 +- ...re-management-frame-from-unexpected-.patch | 66 +++++++++++++++++++ .../hostapd/patches/200-multicall.patch | 4 +- .../hostapd/patches/600-ubus_support.patch | 6 +- 4 files changed, 72 insertions(+), 6 deletions(-) create mode 100644 package/network/services/hostapd/patches/067-0001-AP-Silently-ignore-management-frame-from-unexpected-.patch diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile index ba0f6e6b58..9712e7247a 100644 --- a/package/network/services/hostapd/Makefile +++ b/package/network/services/hostapd/Makefile @@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=hostapd -PKG_RELEASE:=7 +PKG_RELEASE:=8 PKG_SOURCE_URL:=http://w1.fi/hostap.git PKG_SOURCE_PROTO:=git diff --git a/package/network/services/hostapd/patches/067-0001-AP-Silently-ignore-management-frame-from-unexpected-.patch b/package/network/services/hostapd/patches/067-0001-AP-Silently-ignore-management-frame-from-unexpected-.patch new file mode 100644 index 0000000000..2a44dc5885 --- /dev/null +++ b/package/network/services/hostapd/patches/067-0001-AP-Silently-ignore-management-frame-from-unexpected-.patch @@ -0,0 +1,66 @@ +From 8c07fa9eda13e835f3f968b2e1c9a8be3a851ff9 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Thu, 29 Aug 2019 11:52:04 +0300 +Subject: [PATCH] AP: Silently ignore management frame from unexpected source + address + +Do not process any received Management frames with unexpected/invalid SA +so that we do not add any state for unexpected STA addresses or end up +sending out frames to unexpected destination. This prevents unexpected +sequences where an unprotected frame might end up causing the AP to send +out a response to another device and that other device processing the +unexpected response. + +In particular, this prevents some potential denial of service cases +where the unexpected response frame from the AP might result in a +connected station dropping its association. + +Signed-off-by: Jouni Malinen +--- + src/ap/drv_callbacks.c | 13 +++++++++++++ + src/ap/ieee802_11.c | 12 ++++++++++++ + 2 files changed, 25 insertions(+) + +--- a/src/ap/drv_callbacks.c ++++ b/src/ap/drv_callbacks.c +@@ -129,6 +129,19 @@ int hostapd_notif_assoc(struct hostapd_d + "hostapd_notif_assoc: Skip event with no address"); + return -1; + } ++ ++ if (is_multicast_ether_addr(addr) || ++ is_zero_ether_addr(addr) || ++ os_memcmp(addr, hapd->own_addr, ETH_ALEN) == 0) { ++ /* Do not process any frames with unexpected/invalid SA so that ++ * we do not add any state for unexpected STA addresses or end ++ * up sending out frames to unexpected destination. */ ++ wpa_printf(MSG_DEBUG, "%s: Invalid SA=" MACSTR ++ " in received indication - ignore this indication silently", ++ __func__, MAC2STR(addr)); ++ return 0; ++ } ++ + random_add_randomness(addr, ETH_ALEN); + + hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, +--- a/src/ap/ieee802_11.c ++++ b/src/ap/ieee802_11.c +@@ -3929,6 +3929,18 @@ int ieee802_11_mgmt(struct hostapd_data + fc = le_to_host16(mgmt->frame_control); + stype = WLAN_FC_GET_STYPE(fc); + ++ if (is_multicast_ether_addr(mgmt->sa) || ++ is_zero_ether_addr(mgmt->sa) || ++ os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) { ++ /* Do not process any frames with unexpected/invalid SA so that ++ * we do not add any state for unexpected STA addresses or end ++ * up sending out frames to unexpected destination. */ ++ wpa_printf(MSG_DEBUG, "MGMT: Invalid SA=" MACSTR ++ " in received frame - ignore this frame silently", ++ MAC2STR(mgmt->sa)); ++ return 0; ++ } ++ + if (stype == WLAN_FC_STYPE_BEACON) { + handle_beacon(hapd, mgmt, len, fi); + return 1; diff --git a/package/network/services/hostapd/patches/200-multicall.patch b/package/network/services/hostapd/patches/200-multicall.patch index 273af644c6..f2d2d33e21 100644 --- a/package/network/services/hostapd/patches/200-multicall.patch +++ b/package/network/services/hostapd/patches/200-multicall.patch @@ -178,7 +178,7 @@ /* --- a/src/ap/drv_callbacks.c +++ b/src/ap/drv_callbacks.c -@@ -1515,8 +1515,8 @@ static void hostapd_event_wds_sta_interf +@@ -1528,8 +1528,8 @@ static void hostapd_event_wds_sta_interf } @@ -189,7 +189,7 @@ { struct hostapd_data *hapd = ctx; #ifndef CONFIG_NO_STDOUT_DEBUG -@@ -1742,7 +1742,7 @@ void wpa_supplicant_event(void *ctx, enu +@@ -1755,7 +1755,7 @@ void wpa_supplicant_event(void *ctx, enu } diff --git a/package/network/services/hostapd/patches/600-ubus_support.patch b/package/network/services/hostapd/patches/600-ubus_support.patch index 7ac16e62b3..2f4f613654 100644 --- a/package/network/services/hostapd/patches/600-ubus_support.patch +++ b/package/network/services/hostapd/patches/600-ubus_support.patch @@ -193,7 +193,7 @@ sta = ap_get_sta(hapd, mgmt->sa); if (sta == NULL) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying " -@@ -3951,7 +3980,7 @@ int ieee802_11_mgmt(struct hostapd_data +@@ -3963,7 +3992,7 @@ int ieee802_11_mgmt(struct hostapd_data if (stype == WLAN_FC_STYPE_PROBE_REQ) { @@ -202,7 +202,7 @@ return 1; } -@@ -3971,17 +4000,17 @@ int ieee802_11_mgmt(struct hostapd_data +@@ -3983,17 +4012,17 @@ int ieee802_11_mgmt(struct hostapd_data switch (stype) { case WLAN_FC_STYPE_AUTH: wpa_printf(MSG_DEBUG, "mgmt::auth"); @@ -291,7 +291,7 @@ if (addr == NULL) { /* -@@ -195,6 +199,12 @@ int hostapd_notif_assoc(struct hostapd_d +@@ -208,6 +212,12 @@ int hostapd_notif_assoc(struct hostapd_d goto fail; }