svn commit: r337831 - stable/11/contrib/wpa/src/rsn_supp
Xin LI
delphij at FreeBSD.org
Wed Aug 15 05:03:55 UTC 2018
Author: delphij
Date: Wed Aug 15 05:03:54 2018
New Revision: 337831
URL: https://svnweb.freebsd.org/changeset/base/337831
Log:
MFC r337819 (cy@): MFV r337818: WPA: Ignore unauthenticated encrypted EAPOL-Key
data
Approved by: so
Security: CVE-2018-14526
Security: FreeBSD-SA-18:11.hostapd
Modified:
stable/11/contrib/wpa/src/rsn_supp/wpa.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/contrib/wpa/src/rsn_supp/wpa.c
==============================================================================
--- stable/11/contrib/wpa/src/rsn_supp/wpa.c Wed Aug 15 03:03:01 2018 (r337830)
+++ stable/11/contrib/wpa/src/rsn_supp/wpa.c Wed Aug 15 05:03:54 2018 (r337831)
@@ -2072,6 +2072,17 @@ int wpa_sm_rx_eapol(struct wpa_sm *sm, const u8 *src_a
if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) &&
(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
+ /*
+ * Only decrypt the Key Data field if the frame's authenticity
+ * was verified. When using AES-SIV (FILS), the MIC flag is not
+ * set, so this check should only be performed if mic_len != 0
+ * which is the case in this code branch.
+ */
+ if (!(key_info & WPA_KEY_INFO_MIC)) {
+ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
+ "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data");
+ goto out;
+ }
if (wpa_supplicant_decrypt_key_data(sm, key, ver, key_data,
&key_data_len))
goto out;
More information about the svn-src-all
mailing list