From 7899587b4b28e85da84f856ee0c79b23955539d6 Mon Sep 17 00:00:00 2001 From: Kevin Meier Date: Mon, 25 Nov 2019 17:22:10 -0800 Subject: Address wpa_supplicant vulnerabilities These CVEs were found by security review on P.Car: CVE-2019-11555, CVE-2019-16275 This CL implements the required patches. Bug: 145681598 142561564 Test: Boot Hawk and verify Wifi works in P.Car. Test Blueline Wifi hotspot with the changes against qt-qpr1. Change-Id: I8afc4f1edf4676adba87b38ab47ba990e12ead1f --- src/ap/drv_callbacks.c | 13 +++++++++++++ src/ap/ieee802_11.c | 12 ++++++++++++ 2 files changed, 25 insertions(+) diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c index 952a3d55..e3844d97 100644 --- a/src/ap/drv_callbacks.c +++ b/src/ap/drv_callbacks.c @@ -131,6 +131,19 @@ int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr, "hostapd_notif_assoc: Skip event with no address"); return -1; } + + if (is_multicast_ether_addr(addr) || + is_zero_ether_addr(addr) || + os_memcmp(addr, hapd->own_addr, ETH_ALEN) == 0) { + /* Do not process any frames with unexpected/invalid SA so that + * we do not add any state for unexpected STA addresses or end + * up sending out frames to unexpected destination. */ + wpa_printf(MSG_DEBUG, "%s: Invalid SA=" MACSTR + " in received indication - ignore this indication silently", + __func__, MAC2STR(addr)); + return 0; + } + random_add_randomness(addr, ETH_ALEN); hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c index 5cd25626..36161c2b 100644 --- a/src/ap/ieee802_11.c +++ b/src/ap/ieee802_11.c @@ -4461,6 +4461,18 @@ int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len, fc = le_to_host16(mgmt->frame_control); stype = WLAN_FC_GET_STYPE(fc); + if (is_multicast_ether_addr(mgmt->sa) || + is_zero_ether_addr(mgmt->sa) || + os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) { + /* Do not process any frames with unexpected/invalid SA so that + * we do not add any state for unexpected STA addresses or end + * up sending out frames to unexpected destination. */ + wpa_printf(MSG_DEBUG, "MGMT: Invalid SA=" MACSTR + " in received frame - ignore this frame silently", + MAC2STR(mgmt->sa)); + return 0; + } + if (stype == WLAN_FC_STYPE_BEACON) { handle_beacon(hapd, mgmt, len, fi); return 1; -- cgit v1.2.3