From 11ce78e57f4b5b570d6b9f8a17591dc2171addfe Mon Sep 17 00:00:00 2001 From: christos Date: Sat, 9 May 2015 19:46:01 +0000 Subject: [PATCH] The length of the received Commit and Confirm message payloads was not checked before reading them. This could result in a buffer read overflow when processing an invalid message. Fix this by verifying that the payload is of expected length before processing it. In addition, enforce correct state transition sequence to make sure there is no unexpected behavior if receiving a Commit/Confirm message before the previous exchanges have been completed. Thanks to Kostya Kortchinsky of Google security team for discovering and reporting this issue. XXX: pullup-7 --- external/bsd/wpa/dist/src/eap_peer/eap_pwd.c | 17 +++++++++++++++++ .../wpa/dist/src/eap_server/eap_server_pwd.c | 12 ++++++++++++ 2 files changed, 29 insertions(+) diff --git a/external/bsd/wpa/dist/src/eap_peer/eap_pwd.c b/external/bsd/wpa/dist/src/eap_peer/eap_pwd.c index 059bbeecb72d..9d6bc62495cf 100644 --- a/external/bsd/wpa/dist/src/eap_peer/eap_pwd.c +++ b/external/bsd/wpa/dist/src/eap_peer/eap_pwd.c @@ -301,6 +301,23 @@ eap_pwd_perform_commit_exchange(struct eap_sm *sm, struct eap_pwd_data *data, BIGNUM *mask = NULL, *x = NULL, *y = NULL, *cofactor = NULL; u16 offset; u8 *ptr, *scalar = NULL, *element = NULL; + size_t prime_len, order_len; + + if (data->state != PWD_Commit_Req) { + ret->ignore = TRUE; + goto fin; + } + + prime_len = BN_num_bytes(data->grp->prime); + order_len = BN_num_bytes(data->grp->order); + + if (payload_len != 2 * prime_len + order_len) { + wpa_printf(MSG_INFO, + "EAP-pwd: Unexpected Commit payload length %u (expected %u)", + (unsigned int) payload_len, + (unsigned int) (2 * prime_len + order_len)); + goto fin; + } if (((data->private_value = BN_new()) == NULL) || ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) || diff --git a/external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c b/external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c index 943af0d15078..f71ba4a068da 100644 --- a/external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c +++ b/external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c @@ -634,9 +634,21 @@ eap_pwd_process_commit_resp(struct eap_sm *sm, struct eap_pwd_data *data, BIGNUM *x = NULL, *y = NULL, *cofactor = NULL; EC_POINT *K = NULL, *point = NULL; int res = 0; + size_t prime_len, order_len; wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response"); + prime_len = BN_num_bytes(data->grp->prime); + order_len = BN_num_bytes(data->grp->order); + + if (payload_len != 2 * prime_len + order_len) { + wpa_printf(MSG_INFO, + "EAP-pwd: Unexpected Commit payload length %u (expected %u)", + (unsigned int) payload_len, + (unsigned int) (2 * prime_len + order_len)); + goto fin; + } + if (((data->peer_scalar = BN_new()) == NULL) || ((data->k = BN_new()) == NULL) || ((cofactor = BN_new()) == NULL) ||