main/wpa_supplicant: security fix for CVE-2015-1863

fixes #4209

2 files changed, 48 insertions, 1 deletions

diff --git a/main/wpa_supplicant/APKBUILD b/main/wpa_supplicant/APKBUILD
index 5e0ab207ff..b1ac3f98e5 100644
--- a/main/wpa_supplicant/APKBUILD
+++ b/main/wpa_supplicant/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=wpa_supplicant
 pkgver=2.0
-pkgrel=0
+pkgrel=1
 pkgdesc="A utility providing key negotiation for WPA wireless networks"
 url="http://hostap.epitest.fi/wpa_supplicant"
 arch="all"
@@ -10,6 +10,8 @@ subpackages="$pkgname-doc $pkgname-gui"
 depends=
 makedepends="openssl-dev dbus-dev libnl3-dev qt-dev"
 source="http://hostap.epitest.fi/releases/$pkgname-$pkgver.tar.gz
+	CVE-2015-1863.patch
+
 	wpa_supplicant.initd
 	wpa_supplicant.confd
 	"
@@ -147,11 +149,14 @@ gui() {
 }
 
 md5sums="3be2ebfdcced52e00eda0afe2889839d  wpa_supplicant-2.0.tar.gz
+8e8c34267fefcc4142ee142e5515b5df  CVE-2015-1863.patch
 26c9ade15dea7de9a4e650c509c1b3d0  wpa_supplicant.initd
 bc117427f2c538439f3f1481a028ee06  wpa_supplicant.confd"
 sha256sums="2c115609fbb5223d51381084a5c944455a8afcda81d584173ff55ba233379e09  wpa_supplicant-2.0.tar.gz
+a3abf75801f02199ff48c316a7b6598860e6ca20ce2fe79b0bec873905e5c8a4  CVE-2015-1863.patch
 aca6ee6a8640a3b507152560c64e225b1de88e4ceafc5eb331ce2c2f079669e7  wpa_supplicant.initd
 61ec59007f66ac5bacc0aa095d1f2ccbc977a687038e161a463d1727223d5a90  wpa_supplicant.confd"
 sha512sums="c3a599e1dfa5e0bb4b8d35ed49501696ce68c807ff458c1e3bff9ed5619c780f7117c6d8d7cb9a11351e9fad27cf83fc114f255c92552e7ba084de70c5f8e254  wpa_supplicant-2.0.tar.gz
+61f90d06bd42fb7ea17ba147db861303f5b1fdce2cda35492cec578214da5ea5d654a1df99dee4d4a0c07ef3e8b3bfb65ab4b98eff21c2013adf536766136ce1  CVE-2015-1863.patch
 b252a437636bce4497a0779b37103f1c666d473d03bcc64e61c45b7f4a6d391acf49a58dcab18f814a6f18fdf859e9ade107f79f8c1f55330740cbe3780c757e  wpa_supplicant.initd
 29103161ec2b9631fca9e8d9a97fafd60ffac3fe78cf613b834395ddcaf8be1e253c22e060d7d9f9b974b2d7ce794caa932a2125e29f6494b75bce475f7b30e1  wpa_supplicant.confd"
diff --git a/main/wpa_supplicant/CVE-2015-1863.patch b/main/wpa_supplicant/CVE-2015-1863.patch
new file mode 100644
index 0000000000..de1964ca76
--- /dev/null
+++ b/main/wpa_supplicant/CVE-2015-1863.patch
@@ -0,0 +1,42 @@
+From 9ed4eee345f85e3025c33c6e20aa25696e341ccd Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Tue, 7 Apr 2015 11:32:11 +0300
+Subject: [PATCH] P2P: Validate SSID element length before copying it
+ (CVE-2015-1863)
+
+This fixes a possible memcpy overflow for P2P dev->oper_ssid in
+p2p_add_device(). The length provided by the peer device (0..255 bytes)
+was used without proper bounds checking and that could have resulted in
+arbitrary data of up to 223 bytes being written beyond the end of the
+dev->oper_ssid[] array (of which about 150 bytes would be beyond the
+heap allocation) when processing a corrupted management frame for P2P
+peer discovery purposes.
+
+This could result in corrupted state in heap, unexpected program
+behavior due to corrupted P2P peer device information, denial of service
+due to process crash, exposure of memory contents during GO Negotiation,
+and potentially arbitrary code execution.
+
+Thanks to Google security team for reporting this issue and smart
+hardware research group of Alibaba security team for discovering it.
+
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+---
+ src/p2p/p2p.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
+index f584fae..a45fe73 100644
+--- a/src/p2p/p2p.c
++++ b/src/p2p/p2p.c
+@@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq,
+ 	if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
+ 		os_memcpy(dev->interface_addr, addr, ETH_ALEN);
+ 	if (msg.ssid &&
++	    msg.ssid[1] <= sizeof(dev->oper_ssid) &&
+ 	    (msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
+ 	     os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
+ 	     != 0)) {
+-- 
+1.9.1
+