diff options
| author | Jouni Malinen <j@w1.fi> | 2015-10-25 15:45:50 +0200 |
|---|---|---|
| committer | Michael Bestas <mikeioannina@gmail.com> | 2015-11-11 19:40:00 +0200 |
| commit | 6cd240161c881284400d1fa97a4996643c038ba6 (patch) | |
| tree | 343163ff74d385c0a2848cb5011481751eb2e9e6 | |
| parent | d1106abdd415ea5b0f2c20ac1c92bf1aa6765696 (diff) | |
| download | android_external_wpa_supplicant_8-6cd240161c881284400d1fa97a4996643c038ba6.tar.gz android_external_wpa_supplicant_8-6cd240161c881284400d1fa97a4996643c038ba6.tar.bz2 android_external_wpa_supplicant_8-6cd240161c881284400d1fa97a4996643c038ba6.zip | |
WNM: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use
WNM Sleep Mode Response frame is used to update GTK/IGTK only if PMF is
enabled. Verify that PMF is in use before using this field on station
side to avoid accepting unauthenticated key updates. (CVE-2015-5310)
Change-Id: I85b218bcf930624638fef74f918ed78df9752386
Signed-off-by: Jouni Malinen <j@w1.fi>
| -rw-r--r-- | wpa_supplicant/wnm_sta.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c index 810bf296..5df6e4f8 100644 --- a/wpa_supplicant/wnm_sta.c +++ b/wpa_supplicant/wnm_sta.c @@ -185,6 +185,12 @@ static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s, end = ptr + key_len_total; wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total); + if (key_len_total && !wpa_sm_pmf_enabled(wpa_s->wpa)) { + wpa_msg(wpa_s, MSG_INFO, + "WNM: Ignore Key Data in WNM-Sleep Mode Response - PMF not enabled"); + return; + } + while (ptr + 1 < end) { if (ptr + 2 + ptr[1] > end) { wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element " |