Brad Bishop | 64c979e | 2019-11-04 13:55:29 -0500 | [diff] [blame^] | 1 | hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication |
| 2 | of disconnection in certain situations because source address validation is |
| 3 | mishandled. This is a denial of service that should have been prevented by PMF |
| 4 | (aka management frame protection). The attacker must send a crafted 802.11 frame |
| 5 | from a location that is within the 802.11 communications range. |
| 6 | |
| 7 | CVE: CVE-2019-16275 |
| 8 | Upstream-Status: Backport |
| 9 | Signed-off-by: Ross Burton <ross.burton@intel.com> |
| 10 | |
| 11 | From 8c07fa9eda13e835f3f968b2e1c9a8be3a851ff9 Mon Sep 17 00:00:00 2001 |
| 12 | From: Jouni Malinen <j@w1.fi> |
| 13 | Date: Thu, 29 Aug 2019 11:52:04 +0300 |
| 14 | Subject: [PATCH] AP: Silently ignore management frame from unexpected source |
| 15 | address |
| 16 | |
| 17 | Do not process any received Management frames with unexpected/invalid SA |
| 18 | so that we do not add any state for unexpected STA addresses or end up |
| 19 | sending out frames to unexpected destination. This prevents unexpected |
| 20 | sequences where an unprotected frame might end up causing the AP to send |
| 21 | out a response to another device and that other device processing the |
| 22 | unexpected response. |
| 23 | |
| 24 | In particular, this prevents some potential denial of service cases |
| 25 | where the unexpected response frame from the AP might result in a |
| 26 | connected station dropping its association. |
| 27 | |
| 28 | Signed-off-by: Jouni Malinen <j@w1.fi> |
| 29 | --- |
| 30 | src/ap/drv_callbacks.c | 13 +++++++++++++ |
| 31 | src/ap/ieee802_11.c | 12 ++++++++++++ |
| 32 | 2 files changed, 25 insertions(+) |
| 33 | |
| 34 | diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c |
| 35 | index 31587685fe3b..34ca379edc3d 100644 |
| 36 | --- a/src/ap/drv_callbacks.c |
| 37 | +++ b/src/ap/drv_callbacks.c |
| 38 | @@ -131,6 +131,19 @@ int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr, |
| 39 | "hostapd_notif_assoc: Skip event with no address"); |
| 40 | return -1; |
| 41 | } |
| 42 | + |
| 43 | + if (is_multicast_ether_addr(addr) || |
| 44 | + is_zero_ether_addr(addr) || |
| 45 | + os_memcmp(addr, hapd->own_addr, ETH_ALEN) == 0) { |
| 46 | + /* Do not process any frames with unexpected/invalid SA so that |
| 47 | + * we do not add any state for unexpected STA addresses or end |
| 48 | + * up sending out frames to unexpected destination. */ |
| 49 | + wpa_printf(MSG_DEBUG, "%s: Invalid SA=" MACSTR |
| 50 | + " in received indication - ignore this indication silently", |
| 51 | + __func__, MAC2STR(addr)); |
| 52 | + return 0; |
| 53 | + } |
| 54 | + |
| 55 | random_add_randomness(addr, ETH_ALEN); |
| 56 | |
| 57 | hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, |
| 58 | diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c |
| 59 | index c85a28db44b7..e7065372e158 100644 |
| 60 | --- a/src/ap/ieee802_11.c |
| 61 | +++ b/src/ap/ieee802_11.c |
| 62 | @@ -4626,6 +4626,18 @@ int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len, |
| 63 | fc = le_to_host16(mgmt->frame_control); |
| 64 | stype = WLAN_FC_GET_STYPE(fc); |
| 65 | |
| 66 | + if (is_multicast_ether_addr(mgmt->sa) || |
| 67 | + is_zero_ether_addr(mgmt->sa) || |
| 68 | + os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) { |
| 69 | + /* Do not process any frames with unexpected/invalid SA so that |
| 70 | + * we do not add any state for unexpected STA addresses or end |
| 71 | + * up sending out frames to unexpected destination. */ |
| 72 | + wpa_printf(MSG_DEBUG, "MGMT: Invalid SA=" MACSTR |
| 73 | + " in received frame - ignore this frame silently", |
| 74 | + MAC2STR(mgmt->sa)); |
| 75 | + return 0; |
| 76 | + } |
| 77 | + |
| 78 | if (stype == WLAN_FC_STYPE_BEACON) { |
| 79 | handle_beacon(hapd, mgmt, len, fi); |
| 80 | return 1; |
| 81 | -- |
| 82 | 2.20.1 |