Skip to contentSkip to conversation

Patch "mac80211/wpa: use constant time memory comparison for MACs" has been added to the 4.11-stable tree

PATCH [email protected] 1 participant 1 message Jun 18, 2017

Subsystems (2)
Stable branch mac80211
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

mac80211/wpa: use constant time memory comparison for MACs

to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch
and it can be found in the queue-4.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 98c67d187db7808b1f3c95f2110dd4392d034182 Mon Sep 17 00:00:00 2001

From: "Jason A. Donenfeld" <[email protected]>
Date: Sat, 10 Jun 2017 04:59:12 +0200
Subject: mac80211/wpa: use constant time memory comparison for MACs

From: Jason A. Donenfeld <[email protected]>

commit 98c67d187db7808b1f3c95f2110dd4392d034182 upstream.

Otherwise, we enable all sorts of forgeries via timing attack.

Signed-off-by Jason A. Donenfeld <[email protected]>
Cc Johannes Berg <[email protected]>
Cc [email protected]
Signed-off-by Johannes Berg <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 net/mac80211/wpa.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
net/mac80211/wpa.c +5 -4
@@ -17,6 +17,7 @@
 #include <asm/unaligned.h>
 #include <net/mac80211.h>
 #include <crypto/aes.h>
+#include <crypto/algapi.h>
 
 #include "ieee80211_i.h"
 #include "michael.h"

@@ -153,7 +154,7 @@ ieee80211_rx_h_michael_mic_verify(struct
 	data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
 	key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
 	michael_mic(key, hdr, data, data_len, mic);
-	if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0)
+	if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
 		goto mic_fail;
 
 	/* remove Michael MIC from payload */

@@ -1048,7 +1049,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct
 		bip_aad(skb, aad);
 		ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
 				   skb->data + 24, skb->len - 24, mic);
-		if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+		if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
 			key->u.aes_cmac.icverrors++;
 			return RX_DROP_UNUSABLE;
 		}

@@ -1098,7 +1099,7 @@ ieee80211_crypto_aes_cmac_256_decrypt(st
 		bip_aad(skb, aad);
 		ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
 				       skb->data + 24, skb->len - 24, mic);
-		if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+		if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
 			key->u.aes_cmac.icverrors++;
 			return RX_DROP_UNUSABLE;
 		}

@@ -1202,7 +1203,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
 		if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
 				       skb->data + 24, skb->len - 24,
 				       mic) < 0 ||
-		    memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+		    crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
 			key->u.aes_gmac.icverrors++;
 			return RX_DROP_UNUSABLE;
 		}

Patches currently in stable-queue which might be from [email protected] are

queue-4.11/mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch