wpa_supplicant: add upstream security fixes

PATCH New Peter Korsgaard 2 participants 9 messages Oct 16, 2017 – Oct 19, 2017

lore

Share & tools

lore

Peter Korsgaard

author

2017-10-16 11:19 UTC #0 lore raw

PATCH 1/2 wpa_supplicant: add upstream security fixes

Fixes CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088:

http://lists.infradead.org/pipermail/hostap/2017-October/037989.html

Signed-off-by Peter Korsgaard <[email protected]>

---
 package/wpa_supplicant/wpa_supplicant.hash | 6 ++++++
 package/wpa_supplicant/wpa_supplicant.mk   | 7 +++++++
 2 files changed, 13 insertions(+)

package/wpa_supplicant/wpa_supplicant.hash +6 -0

index 22b2e8ddd8..b522661fe0 100644
@@ -1,2 +1,8 @@
 # Locally calculated
 sha256  b4936d34c4e6cdd44954beba74296d964bc2c9668ecaa5255e499636fe2b1450  wpa_supplicant-2.6.tar.gz
+sha256  d86d47ab74170f3648b45b91bce780949ca92b09ab43df065178850ec0c335d7  rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
+sha256  d4535e36739a0cc7f3585e6bcba3c0bb8fc67cb3e729844e448c5dc751f47e81  rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
+sha256  793a54748161b5af430dd9de4a1988d19cb8e85ab29bc2340f886b0297cee20b  rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
+sha256  596d4d3b63ea859ed7ea9791b3a21cb11b6173b04c0a14a2afa47edf1666afa6  rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
+sha256  c5a17af84aec2d88c56ce0da2d6945be398fe7cab5c0c340deb30973900c2736  rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
+sha256  c8840d857b9432f3b488113c85c1ff5d4a4b8d81078b7033388dae1e990843b1  rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch

package/wpa_supplicant/wpa_supplicant.mk +7 -0

index 2e8b82cebe..67b502d6ef 100644
@@ -6,6 +6,13 @@
 
 WPA_SUPPLICANT_VERSION = 2.6
 WPA_SUPPLICANT_SITE = http://hostap.epitest.fi/releases
+WPA_SUPPLICANT_PATCH = \
+	http://w1.fi/security/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch \
+	http://w1.fi/security/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch \
+	http://w1.fi/security/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch \
+	http://w1.fi/security/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch \
+	http://w1.fi/security/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch \
+	http://w1.fi/security/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
 WPA_SUPPLICANT_LICENSE = BSD-3-Clause
 WPA_SUPPLICANT_LICENSE_FILES = README
 WPA_SUPPLICANT_CONFIG = $(WPA_SUPPLICANT_DIR)/wpa_supplicant/.config

Signature · 1 line

2.11.0

Peter Korsgaard

author

2017-10-17 19:40 UTC #1 lore raw

PATCH 1/2 wpa_supplicant: add upstream security fixes

Quoted 8 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088:
http://lists.infradead.org/pipermail/hostap/2017-October/037989.html
Signed-off-by Peter Korsgaard <[email protected]>

Committed after adding patch 0001 as suggested by J?rg, thanks.

Signature · 1 line

Bye, Peter Korsgaard

Jörg Krause

2017-10-17 07:23 UTC #2 lore raw

PATCH 1/2 wpa_supplicant: add upstream security fixes

In reply to Peter Korsgaard

Hi Peter,

Quoted 57 lines · Peter Korsgaard

Fixes CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088:
http://lists.infradead.org/pipermail/hostap/2017-October/037989.html
Signed-off-by Peter Korsgaard <[email protected]>
---
 package/wpa_supplicant/wpa_supplicant.hash | 6 ++++++
 package/wpa_supplicant/wpa_supplicant.mk   | 7 +++++++
 2 files changed, 13 insertions(+)
package/wpa_supplicant/wpa_supplicant.hash +0 -0
index 22b2e8ddd8..b522661fe0 100644
@@ -1,2 +1,8 @@
 # Locally calculated
 sha256  b4936d34c4e6cdd44954beba74296d964bc2c9668ecaa5255e499636fe2b
1450 wpa_supplicant-2.6.tar.gz
+sha256 d86d47ab74170f3648b45b91bce780949ca92b09ab43df065178850ec0c3 35d7 rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use- group-ke.patch
+sha256 d4535e36739a0cc7f3585e6bcba3c0bb8fc67cb3e729844e448c5dc751f4 7e81 rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation- of-WNM-.patch
+sha256 793a54748161b5af430dd9de4a1988d19cb8e85ab29bc2340f886b0297ce e20b rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch +sha256 596d4d3b63ea859ed7ea9791b3a21cb11b6173b04c0a14a2afa47edf1666 afa6 rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch +sha256 c5a17af84aec2d88c56ce0da2d6945be398fe7cab5c0c340deb30973900c 2736 rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without- pending-r.patch
+sha256 c8840d857b9432f3b488113c85c1ff5d4a4b8d81078b7033388dae1e9908 43b1 rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation- Response-fram.patch
package/wpa_supplicant/wpa_supplicant.mk +5 -0
index 2e8b82cebe..67b502d6ef 100644
@@ -6,6 +6,13 @@
 
 WPA_SUPPLICANT_VERSION = 2.6
 WPA_SUPPLICANT_SITE = http://hostap.epitest.fi/releases
+WPA_SUPPLICANT_PATCH = \
+	http://w1.fi/security/2017-1/rebased-v2.6-0002-Prevent-reins
 tallation-of-an-already-in-use-group-ke.patch \
+	http://w1.fi/security/2017-1/rebased-v2.6-0003-Extend-protec
 tion-of-GTK-IGTK-reinstallation-of-WNM-.patch \
+	http://w1.fi/security/2017-1/rebased-v2.6-0004-Prevent-insta
 llation-of-an-all-zero-TK.patch \
+	http://w1.fi/security/2017-1/rebased-v2.6-0006-TDLS-Reject-T
PK-TK-reconfiguration.patch \
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0007-WNM-Ignore-WN
M-Sleep-Mode-Response-without-pending-r.patch \
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0008-FT-Do-not-all

Quoted 4 lines

ow-multiple-Reassociation-Response-fram.patch
WPA_SUPPLICANT_LICENSE = BSD-3-Clause WPA_SUPPLICANT_LICENSE_FILES = README WPA_SUPPLICANT_CONFIG = $(WPA_SUPPLICANT_DIR)/wpa_supplicant/.config

As wpa_supplicant also provides an AP mode capability, which shares the most code with hostap, patch 0001 should be applied, too.

Best regards,
J?rg Krause

Peter Korsgaard

author

2017-10-17 08:18 UTC #3 lore raw

PATCH 1/2 wpa_supplicant: add upstream security fixes

Quoted 60 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"J?rg" == J?rg Krause <[email protected]> writes:
Hi Peter,
Quoted 56 lines · Peter Korsgaard
Fixes CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088:
http://lists.infradead.org/pipermail/hostap/2017-October/037989.html
Signed-off-by Peter Korsgaard <[email protected]>
---
package/wpa_supplicant/wpa_supplicant.hash | 6 ++++++
package/wpa_supplicant/wpa_supplicant.mk | 7 +++++++
2 files changed, 13 insertions(+)
package/wpa_supplicant/wpa_supplicant.hash +0 -0
index 22b2e8ddd8..b522661fe0 100644
@@ -1,2 +1,8 @@
 # Locally calculated
sha256 b4936d34c4e6cdd44954beba74296d964bc2c9668ecaa5255e499636fe2b 1450 wpa_supplicant-2.6.tar.gz
+sha256 d86d47ab74170f3648b45b91bce780949ca92b09ab43df065178850ec0c3 35d7 rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use- group-ke.patch
+sha256 d4535e36739a0cc7f3585e6bcba3c0bb8fc67cb3e729844e448c5dc751f4 7e81 rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation- of-WNM-.patch
+sha256 793a54748161b5af430dd9de4a1988d19cb8e85ab29bc2340f886b0297ce e20b rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch +sha256 596d4d3b63ea859ed7ea9791b3a21cb11b6173b04c0a14a2afa47edf1666 afa6 rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch +sha256 c5a17af84aec2d88c56ce0da2d6945be398fe7cab5c0c340deb30973900c 2736 rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without- pending-r.patch
+sha256 c8840d857b9432f3b488113c85c1ff5d4a4b8d81078b7033388dae1e9908 43b1 rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation- Response-fram.patch
package/wpa_supplicant/wpa_supplicant.mk +0 -0
index 2e8b82cebe..67b502d6ef 100644
@@ -6,6 +6,13 @@
 
WPA_SUPPLICANT_VERSION = 2.6 WPA_SUPPLICANT_SITE = http://hostap.epitest.fi/releases
package/wpa_supplicant/wpa_supplicant.mk +2 -0
+WPA_SUPPLICANT_PATCH = \
+	http://w1.fi/security/2017-1/rebased-v2.6-0002-Prevent-reins
tallation-of-an-already-in-use-group-ke.patch \
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0003-Extend-protec
tion-of-GTK-IGTK-reinstallation-of-WNM-.patch \
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0004-Prevent-insta
llation-of-an-all-zero-TK.patch \
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0006-TDLS-Reject-T
PK-TK-reconfiguration.patch \
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0007-WNM-Ignore-WN
M-Sleep-Mode-Response-without-pending-r.patch \

Quoted 8 lines

Quoted 5 lines
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0008-FT-Do-not-all
ow-multiple-Reassociation-Response-fram.patch WPA_SUPPLICANT_LICENSE = BSD-3-Clause WPA_SUPPLICANT_LICENSE_FILES = README WPA_SUPPLICANT_CONFIG = $(WPA_SUPPLICANT_DIR)/wpa_supplicant/.config
As wpa_supplicant also provides an AP mode capability, which shares the most code with hostap, patch 0001 should be applied, too.

Ok, that wasn't clear from the security announcement (it explicitly says this is for hostapd). Anything else that should be added to this or hostapd?

The whole hostapd/wpa_supplicant mix is kind of confusing to me.

Signature · 1 line

Bye, Peter Korsgaard

Jörg Krause

2017-10-17 08:26 UTC #4 lore raw

PATCH 1/2 wpa_supplicant: add upstream security fixes

Quoted 86 lines · Peter Korsgaard

Quoted 5 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"J?rg" == J?rg Krause <[email protected]> writes:
Hi Peter,
Quoted 1 line · Peter Korsgaard
Fixes CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-
13081,
Quoted 3 lines
Quoted 3 lines
CVE-2017-13087, CVE-2017-13088:
http://lists.infradead.org/pipermail/hostap/2017-October/037989.h
tml
Quoted 7 lines
Quoted 7 lines
Signed-off-by Peter Korsgaard <[email protected]>
---
package/wpa_supplicant/wpa_supplicant.hash | 6 ++++++
package/wpa_supplicant/wpa_supplicant.mk | 7 +++++++
2 files changed, 13 insertions(+)
Quoted 8 lines
package/wpa_supplicant/wpa_supplicant.hash line 2
Quoted 8 lines
package/wpa_supplicant/wpa_supplicant.hash +0 -0
index 22b2e8ddd8..b522661fe0 100644
@@ -1,2 +1,8 @@
 # Locally calculated
 
sha256 b4936d34c4e6cdd44954beba74296d964bc2c9668ecaa5255e499636fe2b
Quoted 2 lines
Quoted 2 lines
1450 wpa_supplicant-2.6.tar.gz
+sha256 d86d47ab74170f3648b45b91bce780949ca92b09ab43df065178850ec0c3
Quoted 1 line
Quoted 1 line
35d7 rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-
use-
Quoted 2 lines
Quoted 2 lines
group-ke.patch
+sha256 d4535e36739a0cc7f3585e6bcba3c0bb8fc67cb3e729844e448c5dc751f4
Quoted 1 line
Quoted 1 line
7e81 rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-
reinstallation-
Quoted 2 lines
Quoted 2 lines
of-WNM-.patch
+sha256 793a54748161b5af430dd9de4a1988d19cb8e85ab29bc2340f886b0297ce
Quoted 1 line
Quoted 1 line
e20b rebased-v2.6-0004-Prevent-installation-of-an-all-zero-
TK.patch
Quoted 1 line
Quoted 1 line
(quoted diff) +2 -0
+sha256  596d4d3b63ea859ed7ea9791b3a21cb11b6173b04c0a14a2afa47edf1666
 >> afa6  rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
 >>
+sha256  c5a17af84aec2d88c56ce0da2d6945be398fe7cab5c0c340deb30973900c
 >> 2736  rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-
without-
Quoted 2 lines
Quoted 2 lines
pending-r.patch
+sha256 c8840d857b9432f3b488113c85c1ff5d4a4b8d81078b7033388dae1e9908
Quoted 9 lines
Quoted 9 lines
43b1 rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation- Response-fram.patch
package/wpa_supplicant/wpa_supplicant.mk +0 -0
index 2e8b82cebe..67b502d6ef 100644
@@ -6,6 +6,13 @@
 
Quoted 4 lines
package/wpa_supplicant/wpa_supplicant.mk
Quoted 4 lines
WPA_SUPPLICANT_VERSION = 2.6 WPA_SUPPLICANT_SITE = http://hostap.epitest.fi/releases
package/wpa_supplicant/wpa_supplicant.mk +2 -0
+WPA_SUPPLICANT_PATCH = \
+	http://w1.fi/security/2017-1/rebased-v2.6-0002-Prevent-r
eins
Quoted 2 lines
package/wpa_supplicant/wpa_supplicant.mk
Quoted 2 lines
tallation-of-an-already-in-use-group-ke.patch \
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0003-Extend-pr
otec
Quoted 2 lines
package/wpa_supplicant/wpa_supplicant.mk
Quoted 2 lines
tion-of-GTK-IGTK-reinstallation-of-WNM-.patch \
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0004-Prevent-i
nsta
Quoted 2 lines
package/wpa_supplicant/wpa_supplicant.mk
Quoted 2 lines
llation-of-an-all-zero-TK.patch \
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0006-TDLS-Reje
ct-T
Quoted 2 lines
package/wpa_supplicant/wpa_supplicant.mk
Quoted 2 lines
PK-TK-reconfiguration.patch \
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0007-WNM-Ignor
e-WN
Quoted 2 lines
package/wpa_supplicant/wpa_supplicant.mk
Quoted 2 lines
M-Sleep-Mode-Response-without-pending-r.patch \
package/wpa_supplicant/wpa_supplicant.mk +1 -0
+	http://w1.fi/security/2017-1/rebased-v2.6-0008-FT-Do-not
-all
Quoted 4 lines
Quoted 4 lines
ow-multiple-Reassociation-Response-fram.patch
WPA_SUPPLICANT_LICENSE = BSD-3-Clause
WPA_SUPPLICANT_LICENSE_FILES = README
WPA_SUPPLICANT_CONFIG =
$(WPA_SUPPLICANT_DIR)/wpa_supplicant/.config

Quoted 7 lines

Quoted 1 line
As wpa_supplicant also provides an AP mode capability, which
shares the
Quoted 1 line
most code with hostap, patch 0001 should be applied, too.
Ok, that wasn't clear from the security announcement (it explicitly says
this is for hostapd).

I haven't checked if the patched functionality is really used by wpa_supplicants AP mode. However, the involved source files are used when building with CONFIG_AP. At least, it does not hurt to apply all patches.

Quoted 1 line

Anything else that should be added to this or hostapd?

Nothing I can think of.

Quoted 1 line

The whole hostapd/wpa_supplicant mix is kind of confusing to me.

That's true.

J?rg.

Peter Korsgaard

author

2017-10-19 15:05 UTC #5 lore raw

PATCH 1/2 wpa_supplicant: add upstream security fixes

In reply to Peter Korsgaard

Quoted 8 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088:
http://lists.infradead.org/pipermail/hostap/2017-October/037989.html
Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.02.x and 2017.08.x, thanks.

Signature · 1 line

Bye, Peter Korsgaard

Peter Korsgaard

author

2017-10-16 11:19 UTC #6 lore raw

PATCH 2/2 hostapd: add upstream security fixes

In reply to Peter Korsgaard

Fixes CVE-2017-13082

http://lists.infradead.org/pipermail/hostap/2017-October/037989.html

Signed-off-by Peter Korsgaard <[email protected]>

---
 package/hostapd/hostapd.hash | 2 ++
 package/hostapd/hostapd.mk   | 3 +++
 2 files changed, 5 insertions(+)

package/hostapd/hostapd.hash +2 -0

index fb891476b3..b20c89b184 100644
@@ -1,2 +1,4 @@
 # Locally calculated
 sha256  01526b90c1d23bec4b0f052039cc4456c2fd19347b4d830d1d58a0a6aea7117d  hostapd-2.6.tar.gz
+sha256  529113cc81256c6178f3c1cf25dd8d3f33e6d770e4a180bd31c6ab7e4917f40b  rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
+sha256  147c8abe07606905d16404fb2d2c8849796ca7c85ed8673c09bb50038bcdeb9e  rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch

package/hostapd/hostapd.mk +3 -0

index 9745d1fd34..e4ca72df63 100644
@@ -6,6 +6,9 @@
 
 HOSTAPD_VERSION = 2.6
 HOSTAPD_SITE = http://w1.fi/releases
+HOSTAPD_PATCH = \
+	http://w1.fi/security/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch \
+	http://w1.fi/security/2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
 HOSTAPD_SUBDIR = hostapd
 HOSTAPD_CONFIG = $(HOSTAPD_DIR)/$(HOSTAPD_SUBDIR)/.config
 HOSTAPD_DEPENDENCIES = host-pkgconf libnl

Signature · 1 line

2.11.0

Peter Korsgaard

author

2017-10-17 19:40 UTC #7 lore raw

PATCH 2/2 hostapd: add upstream security fixes

Quoted 6 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes CVE-2017-13082
http://lists.infradead.org/pipermail/hostap/2017-October/037989.html
Signed-off-by Peter Korsgaard <[email protected]>

Committed, thanks.

Signature · 1 line

Bye, Peter Korsgaard

Peter Korsgaard

author

2017-10-19 15:05 UTC #8 lore raw

PATCH 2/2 hostapd: add upstream security fixes

In reply to Peter Korsgaard

Quoted 6 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes CVE-2017-13082
http://lists.infradead.org/pipermail/hostap/2017-October/037989.html
Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.02.x and 2017.08.x, thanks.

Signature · 1 line

Bye, Peter Korsgaard