Brad Bishop | d5ae7d9 | 2018-06-14 09:52:03 -0700 | [diff] [blame] | 1 | The WPA2 four-way handshake protocol is vulnerable to replay attacks which can |
| 2 | result in unauthenticated clients gaining access to the network. |
| 3 | |
| 4 | Backport a number of patches from upstream to fix this. |
| 5 | |
| 6 | CVE: CVE-2017-13077 |
| 7 | CVE: CVE-2017-13078 |
| 8 | CVE: CVE-2017-13079 |
| 9 | CVE: CVE-2017-13080 |
| 10 | CVE: CVE-2017-13081 |
| 11 | CVE: CVE-2017-13082 |
| 12 | CVE: CVE-2017-13086 |
| 13 | CVE: CVE-2017-13087 |
| 14 | CVE: CVE-2017-13088 |
| 15 | |
| 16 | Upstream-Status: Backport |
| 17 | Signed-off-by: Ross Burton <ross.burton@intel.com> |
| 18 | |
| 19 | From 8280294e74846ea342389a0cd17215050fa5afe8 Mon Sep 17 00:00:00 2001 |
| 20 | From: Jouni Malinen <j@w1.fi> |
| 21 | Date: Sun, 1 Oct 2017 12:12:24 +0300 |
| 22 | Subject: [PATCH 3/8] Extend protection of GTK/IGTK reinstallation of WNM-Sleep |
| 23 | Mode cases |
| 24 | |
| 25 | This extends the protection to track last configured GTK/IGTK value |
| 26 | separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a |
| 27 | corner case where these two different mechanisms may get used when the |
| 28 | GTK/IGTK has changed and tracking a single value is not sufficient to |
| 29 | detect a possible key reconfiguration. |
| 30 | |
| 31 | Signed-off-by: Jouni Malinen <j@w1.fi> |
| 32 | --- |
| 33 | src/rsn_supp/wpa.c | 53 +++++++++++++++++++++++++++++++++++++--------------- |
| 34 | src/rsn_supp/wpa_i.h | 2 ++ |
| 35 | 2 files changed, 40 insertions(+), 15 deletions(-) |
| 36 | |
| 37 | diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c |
| 38 | index 95bd7be..7a2c68d 100644 |
| 39 | --- a/src/rsn_supp/wpa.c |
| 40 | +++ b/src/rsn_supp/wpa.c |
| 41 | @@ -709,14 +709,17 @@ struct wpa_gtk_data { |
| 42 | |
| 43 | static int wpa_supplicant_install_gtk(struct wpa_sm *sm, |
| 44 | const struct wpa_gtk_data *gd, |
| 45 | - const u8 *key_rsc) |
| 46 | + const u8 *key_rsc, int wnm_sleep) |
| 47 | { |
| 48 | const u8 *_gtk = gd->gtk; |
| 49 | u8 gtk_buf[32]; |
| 50 | |
| 51 | /* Detect possible key reinstallation */ |
| 52 | - if (sm->gtk.gtk_len == (size_t) gd->gtk_len && |
| 53 | - os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) { |
| 54 | + if ((sm->gtk.gtk_len == (size_t) gd->gtk_len && |
| 55 | + os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) || |
| 56 | + (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len && |
| 57 | + os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk, |
| 58 | + sm->gtk_wnm_sleep.gtk_len) == 0)) { |
| 59 | wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, |
| 60 | "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)", |
| 61 | gd->keyidx, gd->tx, gd->gtk_len); |
| 62 | @@ -757,8 +760,14 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm, |
| 63 | } |
| 64 | os_memset(gtk_buf, 0, sizeof(gtk_buf)); |
| 65 | |
| 66 | - sm->gtk.gtk_len = gd->gtk_len; |
| 67 | - os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); |
| 68 | + if (wnm_sleep) { |
| 69 | + sm->gtk_wnm_sleep.gtk_len = gd->gtk_len; |
| 70 | + os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk, |
| 71 | + sm->gtk_wnm_sleep.gtk_len); |
| 72 | + } else { |
| 73 | + sm->gtk.gtk_len = gd->gtk_len; |
| 74 | + os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len); |
| 75 | + } |
| 76 | |
| 77 | return 0; |
| 78 | } |
| 79 | @@ -852,7 +861,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, |
| 80 | (wpa_supplicant_check_group_cipher(sm, sm->group_cipher, |
| 81 | gtk_len, gtk_len, |
| 82 | &gd.key_rsc_len, &gd.alg) || |
| 83 | - wpa_supplicant_install_gtk(sm, &gd, key_rsc))) { |
| 84 | + wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) { |
| 85 | wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, |
| 86 | "RSN: Failed to install GTK"); |
| 87 | os_memset(&gd, 0, sizeof(gd)); |
| 88 | @@ -868,14 +877,18 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, |
| 89 | |
| 90 | #ifdef CONFIG_IEEE80211W |
| 91 | static int wpa_supplicant_install_igtk(struct wpa_sm *sm, |
| 92 | - const struct wpa_igtk_kde *igtk) |
| 93 | + const struct wpa_igtk_kde *igtk, |
| 94 | + int wnm_sleep) |
| 95 | { |
| 96 | size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher); |
| 97 | u16 keyidx = WPA_GET_LE16(igtk->keyid); |
| 98 | |
| 99 | /* Detect possible key reinstallation */ |
| 100 | - if (sm->igtk.igtk_len == len && |
| 101 | - os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) { |
| 102 | + if ((sm->igtk.igtk_len == len && |
| 103 | + os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) || |
| 104 | + (sm->igtk_wnm_sleep.igtk_len == len && |
| 105 | + os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk, |
| 106 | + sm->igtk_wnm_sleep.igtk_len) == 0)) { |
| 107 | wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, |
| 108 | "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)", |
| 109 | keyidx); |
| 110 | @@ -900,8 +913,14 @@ static int wpa_supplicant_install_igtk(struct wpa_sm *sm, |
| 111 | return -1; |
| 112 | } |
| 113 | |
| 114 | - sm->igtk.igtk_len = len; |
| 115 | - os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); |
| 116 | + if (wnm_sleep) { |
| 117 | + sm->igtk_wnm_sleep.igtk_len = len; |
| 118 | + os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk, |
| 119 | + sm->igtk_wnm_sleep.igtk_len); |
| 120 | + } else { |
| 121 | + sm->igtk.igtk_len = len; |
| 122 | + os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len); |
| 123 | + } |
| 124 | |
| 125 | return 0; |
| 126 | } |
| 127 | @@ -924,7 +943,7 @@ static int ieee80211w_set_keys(struct wpa_sm *sm, |
| 128 | return -1; |
| 129 | |
| 130 | igtk = (const struct wpa_igtk_kde *) ie->igtk; |
| 131 | - if (wpa_supplicant_install_igtk(sm, igtk) < 0) |
| 132 | + if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0) |
| 133 | return -1; |
| 134 | } |
| 135 | |
| 136 | @@ -1574,7 +1593,7 @@ static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm, |
| 137 | if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc)) |
| 138 | key_rsc = null_rsc; |
| 139 | |
| 140 | - if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) || |
| 141 | + if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) || |
| 142 | wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0) |
| 143 | goto failed; |
| 144 | os_memset(&gd, 0, sizeof(gd)); |
| 145 | @@ -2386,8 +2405,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid) |
| 146 | sm->tptk_set = 0; |
| 147 | os_memset(&sm->tptk, 0, sizeof(sm->tptk)); |
| 148 | os_memset(&sm->gtk, 0, sizeof(sm->gtk)); |
| 149 | + os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); |
| 150 | #ifdef CONFIG_IEEE80211W |
| 151 | os_memset(&sm->igtk, 0, sizeof(sm->igtk)); |
| 152 | + os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); |
| 153 | #endif /* CONFIG_IEEE80211W */ |
| 154 | } |
| 155 | |
| 156 | @@ -2920,8 +2941,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm) |
| 157 | os_memset(&sm->ptk, 0, sizeof(sm->ptk)); |
| 158 | os_memset(&sm->tptk, 0, sizeof(sm->tptk)); |
| 159 | os_memset(&sm->gtk, 0, sizeof(sm->gtk)); |
| 160 | + os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep)); |
| 161 | #ifdef CONFIG_IEEE80211W |
| 162 | os_memset(&sm->igtk, 0, sizeof(sm->igtk)); |
| 163 | + os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep)); |
| 164 | #endif /* CONFIG_IEEE80211W */ |
| 165 | #ifdef CONFIG_IEEE80211R |
| 166 | os_memset(sm->xxkey, 0, sizeof(sm->xxkey)); |
| 167 | @@ -2986,7 +3009,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) |
| 168 | |
| 169 | wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)", |
| 170 | gd.gtk, gd.gtk_len); |
| 171 | - if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) { |
| 172 | + if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) { |
| 173 | os_memset(&gd, 0, sizeof(gd)); |
| 174 | wpa_printf(MSG_DEBUG, "Failed to install the GTK in " |
| 175 | "WNM mode"); |
| 176 | @@ -2998,7 +3021,7 @@ int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf) |
| 177 | const struct wpa_igtk_kde *igtk; |
| 178 | |
| 179 | igtk = (const struct wpa_igtk_kde *) (buf + 2); |
| 180 | - if (wpa_supplicant_install_igtk(sm, igtk) < 0) |
| 181 | + if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0) |
| 182 | return -1; |
| 183 | #endif /* CONFIG_IEEE80211W */ |
| 184 | } else { |
| 185 | diff --git a/src/rsn_supp/wpa_i.h b/src/rsn_supp/wpa_i.h |
| 186 | index afc9e37..9a54631 100644 |
| 187 | --- a/src/rsn_supp/wpa_i.h |
| 188 | +++ b/src/rsn_supp/wpa_i.h |
| 189 | @@ -32,8 +32,10 @@ struct wpa_sm { |
| 190 | int rx_replay_counter_set; |
| 191 | u8 request_counter[WPA_REPLAY_COUNTER_LEN]; |
| 192 | struct wpa_gtk gtk; |
| 193 | + struct wpa_gtk gtk_wnm_sleep; |
| 194 | #ifdef CONFIG_IEEE80211W |
| 195 | struct wpa_igtk igtk; |
| 196 | + struct wpa_igtk igtk_wnm_sleep; |
| 197 | #endif /* CONFIG_IEEE80211W */ |
| 198 | |
| 199 | struct eapol_sm *eapol; /* EAPOL state machine from upper level code */ |
| 200 | -- |
| 201 | 2.7.4 |