aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJouni Malinen <jouni@codeaurora.org>2018-10-29 20:48:07 +0200
committermse1969 <mse1969@posteo.de>2019-02-02 22:05:01 +0100
commit396b9dc5f2673bddbbf554f34df52fd9654a309a (patch)
tree7071de680016d2267a2779a8ecd0264192340033
parentb7de80fb6ac0bf5324f3d69bdb641dc050136799 (diff)
downloadandroid_external_wpa_supplicant_8-396b9dc5f2673bddbbf554f34df52fd9654a309a.tar.gz
android_external_wpa_supplicant_8-396b9dc5f2673bddbbf554f34df52fd9654a309a.tar.bz2
android_external_wpa_supplicant_8-396b9dc5f2673bddbbf554f34df52fd9654a309a.zip
WNM: Fix WNM-Sleep Mode Request bounds checking
ieee802_11_rx_wnmsleep_req() might be called for a short frame that has no more payload after the Public Action field, i.e., with len == 0. The bounds checking for the payload length was done only for the information elements while the one octet Dialog Token field was read unconditionally. This could result in reading one octet beyond the end of the received frame data. Depending on driver interface specific mechanism used for fetching the frame, this could result in reading one octet beyond the end of a stack/hash buffer or reading an uninitialized octet from within a buffer. The actual value that was read as the Dialog Token field is not used since the function returns immediately after having read this value when there is no information elements following the field. This issue was initially added in commit d32d94dbf47a ("WNM: Add WNM-Sleep Mode implementation for AP") (with CONFIG_IEEE80211V=y build option) and it remained in place during number of cleanup and fix changes in this area and renaming of the build parameter to CONFIG_WNM=y. The impacted function was not included in any default build without one of the these optional build options being explicitly enabled. CONFIG_WNM=y is still documented as "experimental and not complete implementation" in hostapd/defconfig. In addition, commit 114f2830d2c2 ("WNM: Ignore WNM-Sleep Mode Request in wnm_sleep_mode=0 case") made this function exit before the impact read if WNM-Sleep Mode support was not explicitly enabled in runtime configuration (wnm_sleep_mode=1 in hostapd.conf). Fix this by explicitly checking the frame has enough payload before reading the Dialog Token field. Bug: 111893132 Change-Id: I4b61e22c39d1a5683923eff34e43bb0c509913d4 Merged-In: I4b61e22c39d1a5683923eff34e43bb0c509913d4 Signed-off-by: Jouni Malinen <jouni@codeaurora.org> (cherry picked from commit 7a543744db8ece2376b019040b5668ede68ebd8b) CVE-2018-9589
-rw-r--r--src/ap/wnm_ap.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
index 4c8bc100..f2615504 100644
--- a/src/ap/wnm_ap.c
+++ b/src/ap/wnm_ap.c
@@ -200,6 +200,13 @@ static void ieee802_11_rx_wnmsleep_req(struct hostapd_data *hapd,
u8 *tfsreq_ie_end = NULL;
u16 tfsreq_ie_len = 0;
+ if (len < 1) {
+ wpa_printf(MSG_DEBUG,
+ "WNM: Ignore too short WNM-Sleep Mode Request from "
+ MACSTR, MAC2STR(addr));
+ return;
+ }
+
dialog_token = *pos++;
while (pos + 1 < frm + len) {
u8 ie_len = pos[1];