From 62ecb530d43d5bdf1a68d3509993e48bddfdb5de Mon Sep 17 00:00:00 2001 From: Natanael Copa Date: Mon, 15 Jun 2015 11:17:48 +0000 Subject: main/wpa_supplicant: various security fixes CVE-2015-4141 CVE-2015-4142 CVE-2015-4143 CVE-2015-4144 CVE-2015-4145 CVE-2015-4146 fixes #4340 fixes #4270 --- ...eer-Fix-asymmetric-fragmentation-behavior.patch | 32 ++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch (limited to 'main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch') diff --git a/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch b/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch new file mode 100644 index 0000000000..a601323f14 --- /dev/null +++ b/main/wpa_supplicant/0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch @@ -0,0 +1,32 @@ +From 28a069a545b06b99eb55ad53f63f2c99e65a98f6 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Sat, 2 May 2015 19:26:28 +0300 +Subject: [PATCH 5/5] EAP-pwd peer: Fix asymmetric fragmentation behavior + +The L (Length) and M (More) flags needs to be cleared before deciding +whether the locally generated response requires fragmentation. This +fixes an issue where these flags from the server could have been invalid +for the following message. In some cases, this could have resulted in +triggering the wpabuf security check that would terminate the process +due to invalid buffer allocation. + +Signed-off-by: Jouni Malinen +--- + src/eap_peer/eap_pwd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c +index 1d2079b..e58b13a 100644 +--- a/src/eap_peer/eap_pwd.c ++++ b/src/eap_peer/eap_pwd.c +@@ -968,6 +968,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, + /* + * we have output! Do we need to fragment it? + */ ++ lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch); + len = wpabuf_len(data->outbuf); + if ((len + EAP_PWD_HDR_SIZE) > data->mtu) { + resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu, +-- +1.9.1 + -- cgit v1.2.3