diff options
| author | Jouni Malinen <j@w1.fi> | 2015-10-25 15:45:50 +0200 |
|---|---|---|
| committer | Anjaneedevi Kapparapu <akappa@codeaurora.org> | 2015-12-02 23:48:25 +0530 |
| commit | 1391e5fbc690a8f76c61be1e1b15e01af8e35304 (patch) | |
| tree | 11bae36d85dc547120e10330073ab13fc8ec528c /wpa_supplicant | |
| parent | 703a1fef0170857775cc2cf07617fbff838a48b8 (diff) | |
| download | android_external_wpa_supplicant_8-1391e5fbc690a8f76c61be1e1b15e01af8e35304.tar.gz android_external_wpa_supplicant_8-1391e5fbc690a8f76c61be1e1b15e01af8e35304.tar.bz2 android_external_wpa_supplicant_8-1391e5fbc690a8f76c61be1e1b15e01af8e35304.zip | |
WNM: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use
WNM Sleep Mode Response frame is used to update GTK/IGTK only if PMF is
enabled. Verify that PMF is in use before using this field on station
side to avoid accepting unauthenticated key updates. (CVE-2015-5310)
Signed-off-by: Jouni Malinen <j@w1.fi>
Git-commit: 2cb28a4c75bd2b5d6a56f43e13bff52a2d12bc13
Git-repo: git://w1.fi/srv/git/hostap.git
Change-Id: I00743c63041d3327492a2193fb5f561b17cdd75d
CRs-Fixed: 931315
Diffstat (limited to 'wpa_supplicant')
| -rw-r--r-- | wpa_supplicant/wnm_sta.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c index 954de67c..7d79499a 100644 --- a/wpa_supplicant/wnm_sta.c +++ b/wpa_supplicant/wnm_sta.c @@ -187,6 +187,12 @@ static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s, end = ptr + key_len_total; wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total); + if (key_len_total && !wpa_sm_pmf_enabled(wpa_s->wpa)) { + wpa_msg(wpa_s, MSG_INFO, + "WNM: Ignore Key Data in WNM-Sleep Mode Response - PMF not enabled"); + return; + } + while (ptr + 1 < end) { if (ptr + 2 + ptr[1] > end) { wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element " |