diff options
author | Natanael Copa <ncopa@alpinelinux.org> | 2015-05-19 13:53:43 +0000 |
---|---|---|
committer | Natanael Copa <ncopa@alpinelinux.org> | 2015-05-19 14:35:08 +0000 |
commit | f884e336d5348fdbdb34376627fb5f949dfc00e4 (patch) | |
tree | 49c02d38cca5cf9cbcaa81565f043f2e704954c2 /main/wpa_supplicant | |
parent | 352a7f37f574c831008970fbe25d74120dede7e5 (diff) | |
download | aports-f884e336d5348fdbdb34376627fb5f949dfc00e4.tar.bz2 aports-f884e336d5348fdbdb34376627fb5f949dfc00e4.tar.xz |
main/wpa_supplicant: security fix for CVE-2015-1863
fixes #4210
Diffstat (limited to 'main/wpa_supplicant')
-rw-r--r-- | main/wpa_supplicant/APKBUILD | 7 | ||||
-rw-r--r-- | main/wpa_supplicant/CVE-2015-1863.patch | 42 |
2 files changed, 48 insertions, 1 deletions
diff --git a/main/wpa_supplicant/APKBUILD b/main/wpa_supplicant/APKBUILD index e73908ca3f..d96d9f03ba 100644 --- a/main/wpa_supplicant/APKBUILD +++ b/main/wpa_supplicant/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=wpa_supplicant pkgver=2.0 -pkgrel=1 +pkgrel=2 pkgdesc="A utility providing key negotiation for WPA wireless networks" url="http://hostap.epitest.fi/wpa_supplicant" arch="all" @@ -10,6 +10,8 @@ subpackages="$pkgname-doc $pkgname-gui" depends="dbus" makedepends="openssl-dev dbus-dev libnl3-dev qt-dev" source="http://hostap.epitest.fi/releases/$pkgname-$pkgver.tar.gz + CVE-2015-1863.patch + wpa_supplicant.initd wpa_supplicant.confd " @@ -147,11 +149,14 @@ gui() { } md5sums="3be2ebfdcced52e00eda0afe2889839d wpa_supplicant-2.0.tar.gz +8e8c34267fefcc4142ee142e5515b5df CVE-2015-1863.patch 8c88d2418857028c8a8c8489b516f22a wpa_supplicant.initd bc117427f2c538439f3f1481a028ee06 wpa_supplicant.confd" sha256sums="2c115609fbb5223d51381084a5c944455a8afcda81d584173ff55ba233379e09 wpa_supplicant-2.0.tar.gz +a3abf75801f02199ff48c316a7b6598860e6ca20ce2fe79b0bec873905e5c8a4 CVE-2015-1863.patch 66b7fd1322540ed39120c453d6f8852b519b67e3efcb3abdc3a76733ff75ecb4 wpa_supplicant.initd 61ec59007f66ac5bacc0aa095d1f2ccbc977a687038e161a463d1727223d5a90 wpa_supplicant.confd" sha512sums="c3a599e1dfa5e0bb4b8d35ed49501696ce68c807ff458c1e3bff9ed5619c780f7117c6d8d7cb9a11351e9fad27cf83fc114f255c92552e7ba084de70c5f8e254 wpa_supplicant-2.0.tar.gz +61f90d06bd42fb7ea17ba147db861303f5b1fdce2cda35492cec578214da5ea5d654a1df99dee4d4a0c07ef3e8b3bfb65ab4b98eff21c2013adf536766136ce1 CVE-2015-1863.patch 12a59d1f60f61aea6733add7d8a961fb728d27c156c49481775194cc655b1cec77f021624cf6a9cd93d0e5db12ebfca315a41801f03213919cf2b896b901f3bb wpa_supplicant.initd 29103161ec2b9631fca9e8d9a97fafd60ffac3fe78cf613b834395ddcaf8be1e253c22e060d7d9f9b974b2d7ce794caa932a2125e29f6494b75bce475f7b30e1 wpa_supplicant.confd" diff --git a/main/wpa_supplicant/CVE-2015-1863.patch b/main/wpa_supplicant/CVE-2015-1863.patch new file mode 100644 index 0000000000..de1964ca76 --- /dev/null +++ b/main/wpa_supplicant/CVE-2015-1863.patch @@ -0,0 +1,42 @@ +From 9ed4eee345f85e3025c33c6e20aa25696e341ccd Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <jouni@qca.qualcomm.com> +Date: Tue, 7 Apr 2015 11:32:11 +0300 +Subject: [PATCH] P2P: Validate SSID element length before copying it + (CVE-2015-1863) + +This fixes a possible memcpy overflow for P2P dev->oper_ssid in +p2p_add_device(). The length provided by the peer device (0..255 bytes) +was used without proper bounds checking and that could have resulted in +arbitrary data of up to 223 bytes being written beyond the end of the +dev->oper_ssid[] array (of which about 150 bytes would be beyond the +heap allocation) when processing a corrupted management frame for P2P +peer discovery purposes. + +This could result in corrupted state in heap, unexpected program +behavior due to corrupted P2P peer device information, denial of service +due to process crash, exposure of memory contents during GO Negotiation, +and potentially arbitrary code execution. + +Thanks to Google security team for reporting this issue and smart +hardware research group of Alibaba security team for discovering it. + +Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> +--- + src/p2p/p2p.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c +index f584fae..a45fe73 100644 +--- a/src/p2p/p2p.c ++++ b/src/p2p/p2p.c +@@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq, + if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0) + os_memcpy(dev->interface_addr, addr, ETH_ALEN); + if (msg.ssid && ++ msg.ssid[1] <= sizeof(dev->oper_ssid) && + (msg.ssid[1] != P2P_WILDCARD_SSID_LEN || + os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) + != 0)) { +-- +1.9.1 + |