1 This patch combines the following upstream security fixes:
3 28a069a545b0 EAP-pwd peer: Fix asymmetric fragmentation behavior
4 3035cc2894e0 EAP-pwd server: Fix Total-Length parsing for fragment reassembly
5 477c74395acd EAP-pwd peer: Fix Total-Length parsing for fragment reassembly
6 e28a58be2618 EAP-pwd server: Fix payload length validation for Commit and Confirm
7 dd2f043c9c43 EAP-pwd peer: Fix payload length validation for Commit and Confirm
10 http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt
12 Signed-off-by: Baruch Siach <baruch@tkos.co.il>
14 diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
15 index f2b092669a42..e58b13a42f73 100644
16 --- a/src/eap_peer/eap_pwd.c
17 +++ b/src/eap_peer/eap_pwd.c
18 @@ -355,6 +355,23 @@ eap_pwd_perform_commit_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
19 BIGNUM *mask = NULL, *x = NULL, *y = NULL, *cofactor = NULL;
21 u8 *ptr, *scalar = NULL, *element = NULL;
22 + size_t prime_len, order_len;
24 + if (data->state != PWD_Commit_Req) {
29 + prime_len = BN_num_bytes(data->grp->prime);
30 + order_len = BN_num_bytes(data->grp->order);
32 + if (payload_len != 2 * prime_len + order_len) {
33 + wpa_printf(MSG_INFO,
34 + "EAP-pwd: Unexpected Commit payload length %u (expected %u)",
35 + (unsigned int) payload_len,
36 + (unsigned int) (2 * prime_len + order_len));
40 if (((data->private_value = BN_new()) == NULL) ||
41 ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) ||
42 @@ -554,6 +571,18 @@ eap_pwd_perform_confirm_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
43 u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr;
46 + if (data->state != PWD_Confirm_Req) {
51 + if (payload_len != SHA256_MAC_LEN) {
52 + wpa_printf(MSG_INFO,
53 + "EAP-pwd: Unexpected Confirm payload length %u (expected %u)",
54 + (unsigned int) payload_len, SHA256_MAC_LEN);
59 * first build up the ciphersuite which is group | random_function |
61 @@ -837,11 +866,23 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
62 * if it's the first fragment there'll be a length field
64 if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {
66 + wpa_printf(MSG_DEBUG,
67 + "EAP-pwd: Frame too short to contain Total-Length field");
71 tot_len = WPA_GET_BE16(pos);
72 wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments whose "
73 "total length = %d", tot_len);
77 + wpa_printf(MSG_DEBUG,
78 + "EAP-pwd: Unexpected new fragment start when previous fragment is still in use");
82 data->inbuf = wpabuf_alloc(tot_len);
83 if (data->inbuf == NULL) {
84 wpa_printf(MSG_INFO, "Out of memory to buffer "
85 @@ -927,6 +968,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
87 * we have output! Do we need to fragment it?
89 + lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch);
90 len = wpabuf_len(data->outbuf);
91 if ((len + EAP_PWD_HDR_SIZE) > data->mtu) {
92 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu,
93 diff --git a/src/eap_server/eap_server_pwd.c b/src/eap_server/eap_server_pwd.c
94 index 66bd5d2e9179..2bfc3c27647d 100644
95 --- a/src/eap_server/eap_server_pwd.c
96 +++ b/src/eap_server/eap_server_pwd.c
97 @@ -656,9 +656,21 @@ eap_pwd_process_commit_resp(struct eap_sm *sm, struct eap_pwd_data *data,
98 BIGNUM *x = NULL, *y = NULL, *cofactor = NULL;
99 EC_POINT *K = NULL, *point = NULL;
101 + size_t prime_len, order_len;
103 wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response");
105 + prime_len = BN_num_bytes(data->grp->prime);
106 + order_len = BN_num_bytes(data->grp->order);
108 + if (payload_len != 2 * prime_len + order_len) {
109 + wpa_printf(MSG_INFO,
110 + "EAP-pwd: Unexpected Commit payload length %u (expected %u)",
111 + (unsigned int) payload_len,
112 + (unsigned int) (2 * prime_len + order_len));
116 if (((data->peer_scalar = BN_new()) == NULL) ||
117 ((data->k = BN_new()) == NULL) ||
118 ((cofactor = BN_new()) == NULL) ||
119 @@ -774,6 +786,13 @@ eap_pwd_process_confirm_resp(struct eap_sm *sm, struct eap_pwd_data *data,
120 u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr;
123 + if (payload_len != SHA256_MAC_LEN) {
124 + wpa_printf(MSG_INFO,
125 + "EAP-pwd: Unexpected Confirm payload length %u (expected %u)",
126 + (unsigned int) payload_len, SHA256_MAC_LEN);
130 /* build up the ciphersuite: group | random_function | prf */
131 grp = htons(data->group_num);
133 @@ -923,11 +942,21 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv,
134 * the first fragment has a total length
136 if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {
138 + wpa_printf(MSG_DEBUG,
139 + "EAP-pwd: Frame too short to contain Total-Length field");
142 tot_len = WPA_GET_BE16(pos);
143 wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments, total "
144 "length = %d", tot_len);
148 + wpa_printf(MSG_DEBUG,
149 + "EAP-pwd: Unexpected new fragment start when previous fragment is still in use");
152 data->inbuf = wpabuf_alloc(tot_len);
153 if (data->inbuf == NULL) {
154 wpa_printf(MSG_INFO, "EAP-pwd: Out of memory to "