diff options
Diffstat (limited to 'meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0013-EAP-pwd-client-Verify-received-scalar-and-element.patch')
| -rw-r--r-- | meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0013-EAP-pwd-client-Verify-received-scalar-and-element.patch | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0013-EAP-pwd-client-Verify-received-scalar-and-element.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0013-EAP-pwd-client-Verify-received-scalar-and-element.patch new file mode 100644 index 0000000000..c6e61cb803 --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0013-EAP-pwd-client-Verify-received-scalar-and-element.patch @@ -0,0 +1,61 @@ +From 8ad8585f91823ddcc3728155e288e0f9f872e31a Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef <mathy.vanhoef@nyu.edu> +Date: Sun, 31 Mar 2019 17:43:44 +0200 +Subject: [PATCH 13/14] EAP-pwd client: Verify received scalar and element + +When processing an EAP-pwd Commit frame, the server's scalar and element +(elliptic curve point) were not validated. This allowed an adversary to +bypass authentication, and act as a rogue Access Point (AP) if the +crypto implementation did not verify the validity of the EC point. + +Fix this vulnerability by assuring the received scalar lies within the +valid range, and by checking that the received element is not the point +at infinity and lies on the elliptic curve being used. (CVE-2019-9499) + +The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower +is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL +(and also BoringSSL) implicitly validate the elliptic curve point in +EC_POINT_set_affine_coordinates_GFp(), preventing the attack. + +Signed-off-by: Mathy Vanhoef <mathy.vanhoef@nyu.edu> +Signed-off-by: Adrian Bunk <bunk@stusta.de> +Upstream-Status: Backport +CVE: CVE-2019-9499 +--- + src/eap_peer/eap_pwd.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c +index 761c16a..5a05e54 100644 +--- a/src/eap_peer/eap_pwd.c ++++ b/src/eap_peer/eap_pwd.c +@@ -594,6 +594,26 @@ eap_pwd_perform_commit_exchange(struct eap_sm *sm, struct eap_pwd_data *data, + goto fin; + } + ++ /* verify received scalar */ ++ if (crypto_bignum_is_zero(data->server_scalar) || ++ crypto_bignum_is_one(data->server_scalar) || ++ crypto_bignum_cmp(data->server_scalar, ++ crypto_ec_get_order(data->grp->group)) >= 0) { ++ wpa_printf(MSG_INFO, ++ "EAP-PWD (peer): received scalar is invalid"); ++ goto fin; ++ } ++ ++ /* verify received element */ ++ if (!crypto_ec_point_is_on_curve(data->grp->group, ++ data->server_element) || ++ crypto_ec_point_is_at_infinity(data->grp->group, ++ data->server_element)) { ++ wpa_printf(MSG_INFO, ++ "EAP-PWD (peer): received element is invalid"); ++ goto fin; ++ } ++ + /* check to ensure server's element is not in a small sub-group */ + if (!crypto_bignum_is_one(cofactor)) { + if (crypto_ec_point_mul(data->grp->group, data->server_element, +-- +2.7.4 + |